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VOLUME  IV 
IN  THE  UNITED  STATES  ARMY 

UNITED  STATES 
VS. 

MANNING,    Bradley  E.,    PFC  COURT-MARTIAL 
U.S.   Army,    xxx— xx— 9504 

Headquarters  and  Headquarters  Company, 

U.S.   Army  Garrison, 

Joint  Base  Myer— Henderson  Hall, 

Fort  Myer,   VA  22211 

 / 

The  Hearing  in  the  above— entitled  matter  was 
held  on  Monday,    June  10,    2013,    commencing  at  1:35  p.m., 
at  Fort  Meade,   Maryland,   before  the  Honorable  Colonel 
Denise  Lind,  Judge. 
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DISCLAIMER 

This  transcript  was  made  by  a  court  reporter 
who  is  not  the  official  Government  reporter,   was  not 
permitted  to  be  in  the  actual  courtroom  where  the 
proceedings  took  place,   but  in  a  media  room  listening 
to  and  watching  live  audio/video  feed,   not  permitted  to 
make  an  audio  backup  recording  for  editing  purposes, 
and  not  having  the  ability  to  control  the  proceedings 
in  order  to  produce  an  accurate  verbatim  transcript . 

This  unedited,    uncertified  draft  transcript 
may  contain  court  reporting  outlines  that  are  not 
translated,   notes  made  by  the  reporter  for  editing 
purposes,   misspelled  terms  and  names,   word  combinations 
that  do  not  make  sense,    and  missing  testimony  or 
colloquy  due  to  being  inaudible  by  the  reporter. 
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ON  BEHALF  OF  THE  GOVERNMENT: 
CAPTAIN  JOSEPH  MORROW 
MAJOR  ASHDEN  FEIN 
CAPTAIN  ANGEL  OVERGAARD 

ON  BEHALF  OF  THE  ACCUSED: 
DAVID  COOMBS 
MAJOR  THOMAS  HURLEY 
CAPTAIN  JOSHUA  TOOMA 
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PROCEEDINGS, 
(Reconvened  at  1:35  p.m.) 

THE  COURT:     Please  be  seated.      Court  is 
called  to  order.     Major  Fein? 

MAJOR  FEIN:     Parties  in  the  last  recesses 
are  again  present,    Your  Honor.      Captain  Whyte  is  absent 
and  Captain  Overgaard  is  present . 

THE  COURT :     All  right .     During  the  lunch 
recess  that  went  a  little  bit  longer,   a  lot  longer. 
The  parties  have  presented  me  with  some  stipulations  of 
expected  testimony  that  both  sides  have  agreed  to  and 
PFC  Manning  has  agreed  to.      I  count  a  total  of  19  on 
both  sides . 

MR.   HURLEY:     Yes,  ma'am. 

MAJOR  FEIN:     Yes,   ma'am.      I  believe  that's 
19,   one  classified,   and  then  there's  an  unclassified 
redacted  version  as  well,   but  it's  the  same. 

THE  COURT :      I  need  to  go  over  these 
stipulations  with  PFC  Manning.     Does  he  have  them  in 
order  or  exhibit  number? 

MR.   HURLEY:     He  has  them  in  order  of 
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prosecution  exhibits  numbers . 

THE  COURT:     Excuse  me? 

MR.   HURLEY:     Yes,   ma'am.     May  we  wait  a 
second  just  to  make  sure  that ' s  right . 

THE  COURT :     Do  it  any  way .      I  can  do  it 
alphabetically  or  whatever  makes  sense  to  you . 

CAPTAIN  HURLEY:      I  apologize.  What 
we've  done  is  we've  set  them  up  in  order  of  the 
witness  testimony  according  to  the  witness  list 
proposed  by  the  government .     So  that ' s  the  order 
that  they're  currently  in  now. 

THE  COURT:     Will  it  be  faster  for  all  to 
take  my  copies  and  match  them  to  his  orders? 

MR.   HURLEY:     Ma'am,    I  think  it  will  be 
faster  if  we  took  our  copies  and  matched  them  to  the 
prosecution  ID  numbers . 

THE  COURT:     All  right.      (matching  copies) . 

MR.   HURLEY:     Ma'am,   we  did  our  best. 

THE  COURT:      Thank  you.     PFC  Manning,  the 
one  question  I  would  want  to  ask  you  before  we  get  into 
your  colloquy,   there's  19  of  these  stipulations  of 
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expected  testimony  and  as  I  hold  them  in  my  hand  they 
can  be  the  size  of  a  small  paperclip  to  hold  them 
together . 

Have  you  had  an  opportunity  to  read  each 
one  of  these  stipulations .     Have  you  had  enough  time 
to  have  reviewed  all  of  these  and  are  comfortable 
(INAUDIBLE)   to  through  these  with  me  now. 

THE  WITNESS:     Yes,  ma'am. 

THE  COURT :      I  know  some  are  dated  7  June 
and  some  are  dated  9  and  10  June,   and  I  just  noticed 
here  on  my  copy  of  the  redacted  classified  version 
doesn't  have  a  date.      Is  that  for  a  reason? 

MR.   HURLEY:     No,  ma'am. 

MAJOR  FEIN:     No,   ma'am,    the  original 
classified  versus  indicated  10  June. 

THE  COURT:      The  redacted  version? 

MR.   HURLEY:     Yes,  ma'am. 

THE  COURT:     Now  that  we've  looked  at  that 
one,    I  also  was  advised  by  the  parties  who  came  into  my 
office  that  lasted  about  two  minutes,   that  a  couple  of 
these  stipulations,   and  this  is  —  look  at  the  one  to 
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Lieutenant  commander  has  been  a  redacted  copy  on  page 
2 .      Look  on  paragraph  8 . 

It  has  prosecution  exhibit  and  then  it's 
handwritten  87  for  identification.      The  parties 
advised  in  the  802  witness  with  the  stipulations  of 
expected  testimony  and  you  made  handwritten  notes  or 
changes  on  it . 

PFC  Manning,   would  you  initiate  it,  your 
defense  counsel  would  initial  it,   and  the  government 
would  initial  it;   but  this  looks  like  it  was  just 
added  as  part  of  the  original  stipulation. 

Is  that  my  understanding  of  the  parties? 

MR.   HURLEY:     Yes,   ma'am,   we  received  them 
from  the  government.      They've  already  handwritten  in 
the  prosecution  exhibit  the  time  we  reviewed  it  and 
signed  it . 

THE  COURT:      That  is  correct. 
MAJOR  FEIN:     Yes,  ma'am. 

THE  COURT :     And  PFC  Manning  you  that  agreed 

to  that? 

THE  WITNESS:     Yes,  ma'am. 
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THE  COURT :     And  based  just  on  the 
stipulations,   but  didn't  know  the  appellate  exhibit 
number,    the  ones  we  were  referring  to  at    (INAUDIBLE) . 

MR.   HURLEY:     Yes,   ma'am.     As  we  were  going 
back  and  forth  on  content  and  once  we  got  down  to  the 
specifics  testimony.  (INAUDIBLE) 

THE  COURT:     Did  you  tell  either  side  that 
they  need  to  go  through  and  initial  these? 


through  them  one— by— one  to  make  sure  we ' re  both  talking 
about  the  same  thing.     Prosecution  Exhibit  70  for 
identification,   which  is  stipulation  of  expected 
testimony  from  Mr.   Peter  Artale . 


MR.   HURLEY:     No,   ma'am,    not  for  all  19. 


MAJOR  FEIN:     No,  ma'am. 


THE  COURT :     All  right .  Let 


s   just  go 


MAJOR  FEIN:     Artale,  ma'am. 


THE  COURT:     Artale.     Do  you  have  them. 


THE  WITNESS: 


Yes ,   ma  '  am . 


THE  COURT: 


And  the  second  one  I  have  is 


Mr .    Sean  Chamberlin .     Do  you  have  that  one  as 


Prosecution  Exhibit  712. 
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THE  WITNESS:     Yes,    Your  Honor. 

THE  COURT:      The  next  one  I  have  is 
stipulation  of  expected  testimony  of  Special  Agent  John 
Wilbar,   which  is  prosecution  Exhibit  72  for 
identification . 

THE  WITNESS:     Yes,   ma'am,   Your  Honor. 

THE  COURT:      The  next  one  is  James  Fung, 
Prosecution  Exhibit  73  for  identification. 

THE  WITNESS:     Yes,    Your  Honor. 

THE  COURT :     And  next  one  is  Alex  Aithers 
Prosecution  Exhibit  74  for  identification. 

THE  WITNESS:     Yes,  ma'am. 

THE  COURT :      The  next  one  is  James  McManus  7 
June  2013,    Prosecution  Exhibit  75  for  identification. 

THE  WITNESS:     Yes,  ma'am. 

THE  COURT :  The  next  one  is  no  Special 
Agent  Troy  Bettencourt,  Prosecution  Exhibit  7  6  for 
identification . 

THE  WITNESS:     Yes,  ma'am. 

THE  COURT :     Next  one  is  Special  Agent  Kirk 
Ellis  prosecution  Exhibit  77  for  identification. 
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THE  WITNESS:     Yes,  ma'am. 

THE  COURT :     Next  one  is  Special  Agent  Mark 
Mander,    Prosecution  78  for  identification. 

THE  WITNESS:     Yes,  ma'am. 

THE  COURT:     Next  is  one  is  Doug 
Schasteen,   Prosecution  80  for  identification. 

THE  WITNESS:     Yes,  ma'am. 

THE  COURT:     Next  one  is  Prosecution  106  for 
identification,   Mr.    Jacob    (INAUDIBLE) . 

THE  WITNESS:     Yes,    Your  Honor. 

THE  COURT:     And  next  one  Ms.  (INAUDIBLE) 
white  Prosecution  Exhibit  107  for  identification. 

THE  WITNESS:     Yes,    Your  Honor. 

THE  COURT :     Next  one  is  Lieutenant 
Commander  Thomas  Hopkins,    U.S.   Navy  Reserve, 
Prosecution  Exhibit  111B  Bravo. 

THE  WITNESS:     Yes,  ma'am. 

THE  COURT :     Next  one  is  Lieutenant  Colonel 
retired  Martin  Nehring,   Prosecution  Exhibit  112  for 
identification . 

THE  WITNESS:     Yes,  ma'am. 
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THE  COURT:     Next  one  is  Debra  van  Alstyne, 
Prosecution  Exhibit  114  for  identification. 

THE  WITNESS:     Yes,    Your  Honor. 

THE  COURT:     Next  one  is  Mr.   Wyatt  Bora, 
Prosecution  Exhibit~115  for  identification. 

THE  WITNESS:     Yes,    Your  Honor. 

THE  COURT :     Next  one  I  have  is  Mr .  Patrick 
Hoeffell.      Is  that  how  you  pronounce  his  name? 

MAJOR  FEIN:     Yes,  ma'am. 

THE  COURT :     And  that  would  be  Prosecution 
Exhibit~116  for  identification. 

THE  WITNESS:     Yes,    Your  Honor. 

THE  COURT:     And  then  I  have  CW5  Jon  LaRue, 
Prosecution  Exhibit~117  for  identification. 

THE  WITNESS:     Yes,    Your  Honor. 

THE  COURT:     And  then  I  have  Ms.  Jacqueline 
Scott  which  is  Prosecution  116  for  identification. 

THE  WITNESS:      I  have  119. 

THE  COURT :     Okay .      It  looks  look  6  to  me . 
That  would  be  119  for  identification;    is  that  right? 
MAJOR  FEIN:     Yes,  ma'am. 
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THE  WITNESS:     Yes,    Your  Honor. 

THE  COURT :     Do  you  have  any  other 
stipulations  of  expected  testimony  that  I  haven't 
referenced? 

THE  WITNESS:     No,  ma'am. 

THE  COURT :     Before  signing  each  of  these 
stipulations  —  first  of  all,   are  the  signatures  on  the 
backs  of  these  stipulations . 

THE  WITNESS:     Yes,   ma'am,    except  for  the 
redacted  one . 

THE  COURT:      Is  your  signature  on  the  back 
of  the  original? 

THE  WITNESS:  Yes. 

THE  COURT:  And  that  would  be  for  the 
record  Prosecution  Exhibit  11 IB  Bravo,  Lieutenant 
Colonel  Thomas  Hopkins . 

MR.   HURLEY:     What  we  have  redacted  and 
Alpha  is  the  original . 

MAJOR  FEIN :     We ' re  Alpha  for  you  if  you ' d 
like  to  look  at  it  right  now. 

THE  COURT:      Let  me  —  before  we  begin,  let 
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me  look  at  that  one .     Has  PFC  Manning,    has  he  had  an 
opportunity  to  look  at  111  Alpha? 

MR.   HURLEY:     Yes,   ma'am,    he  has. 

THE  COURT :     Why  don ' t  you  give  it  to  me 
just  so  I  can  see  it . 

MAJOR  FEIN:     May  I  approach? 

THE  COURT :     Yes .      I'm  looking  at  a  copy  of 
what's  been  marked  as  Prosecution  Exhibit  111  Alpha. 
It  looks  like  there  are  redactions  PFC  Manning  at  the 
top  and  bottom  of  each  page,   but  the  substance  of  the 
redaction  that  I  want  to  talk  about  with  you  is 
paragraph  16,    redacted  in  the  redacted  copy. 

Have  you  had  an  opportunity  to  review 
the  paragraph  16  in  the  original  exhibit. 

THE  WITNESS:     Yes,    Your  Honor. 

THE  COURT :     You ' ve  had  the  opportunity  to 
thoroughly  read  that? 

THE  WITNESS:     Yes,    it's  correct. 

THE  COURT :     You  can  take  that  back . 

PFC  Manning,   with  each  of  these  19 
stipulations  before  you  signed  them,   did  you  read 
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them  thoroughly? 

THE  WITNESS:  Yes. 

THE  COURT:     Do  you  understand  the  contents 
of  the  stipulations . 

THE  WITNESS:     Yes,  ma'am. 

THE  COURT :     Do  you  have  approve  of  the 
content  of  the  stipulations . 

THE  WITNESS:     Yes,    Your  Honor. 

THE  COURT :     Before  signing  the 
stipulations,   did  your  defense  counsel  explain  the 
stipulations  to  you? 

THE  WITNESS:     Yes,    Your  Honor. 

THE  COURT :     You  understand  you  have  an 
absolute  right  to  the  refuse  the  stipulation,  the 
contents  of  the  documents  and  you  should  stipulate  to 
them  only  if  you  believe  it ' s  in  your  best  interests . 

THE  WITNESS:     Yes,    Your  Honor. 

THE  COURT:     Once  all  of  these  stipulations 
or  expected  testimony,   which  means  that  counsel  from 
both  sides  agree  the  to  stipulations  for  expected 
testimony,   you're  agreeing  that  each  of  these  19 
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witnesses  if  they  were  sitting  here  in  the  witness 
stand  today  they  would  testify  substantially  as  what's 
in  the  stipulation  of  expected  testimony  that ' s  geared 
to  them  and  if  they  were  under  oath  that's  exactly  what 
they  would  testify. 

You ' re  not  agreeing  to  the  truth  of  what 
they're  saying.      Their  stipulation  and  testimony  can 
be  attacked  the  same  way  that  if  the  person  was 
testifying  here  live.     They  can  would  be 
contradicted  and  they  can  be  explained  in  the  same 
way  as  if  they  were  here  testifying  here  in  live  in 
court.     Do  you  understand  that? 

THE  WITNESS:     Yes,    Your  Honor. 

THE  COURT:     And  what  I've  told  you  earlier 
and  what  your  defense  counsel  has  told  you  and  what 
I've  told  you  today,   do  you  still  desire  to  enter  into 
these  stipulations? 

THE  WITNESS:     Yes,    Your  Honor. 

THE  COURT :     Did  counsel  explain  the 
contents  of  each  of  these  19  stipulations? 

MR.   HURLEY:     Yes,  ma'am. 
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THE  COURT :      So  I  admit  them  as  evidence  now 
or  can  we  go  through  — 

MAJOR  FEIN :     Admit  them  and  we ' 11  read  them 
as  we  go  through . 

THE  COURT :      All  right . 

Prosecution  Exhibit  7  0  for 
identification  is  stipulation  of  expected  testimony 
of  Mr.   Peter  Artale  is  admitted. 

Prosecution  Exhibit  71  for 
identification  the  stipulation  of  expected  testimony 
of  Mr.    Sean  Chamber lin  is  admitted. 

Prosecution  Exhibit  72,    Special  Agent 
John  Wilbar  for  identification  is  admitted. 

I'm  not  going  say  stipulation  of 
expected  testimony  with  each  of  these.      I'll  just 
say,    Prosecution  Exhibit  73  of  James  Fung  is 
admitted. 

Prosecution  Exhibit  74,   Mr.   Alex  Withers 

is  admitted. 

Prosecution  Exhibit  75,   Mr.  James 
McManus  is  admitted. 
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Prosecution  Exhibit  7  6,    Special  Agent 
Troy  Bettencourt  is  admitted. 

Prosecution  Exhibit  77,    Special  Agent 
Kirk  Ellis  is  admitted. 

Prosecution  Exhibit  78,    Special  Agent 
Mark  Mander  is  admitted. 

Prosecution  Exhibit  7  9,   Mr.  Doug 
Schasteen  is  admitted.     Wait  a  minute. 

MR.   COOMBS:     Ma'am,   that's  Prosecution 

Exhibit  80 . 

THE  COURT:     Why  do  I  have  7  9  here? 
Prosecution  7  9  is  not  admitted. 

7  9,   Mr.   Doug  Schasteen,  Prosecution 
Exhibit  80  for  identification  is  admitted. 

Prosecution  Exhibit~106  Mr.    Jacob  Grant 

is  admitted. 

Prosecution  Exhibit  107,   Ms.  Lorindo 
White  is  admitted. 

Prosecution  Exhibit  111  Alpha,   which  is 
the  classified  version,   which  I  can  initial  later  on 
at  recess,    and  Prosecution  Exhibit  111B  for 
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identification  are  admitted. 

Prosecution  Exhibit  112  Lieutenant 
Colonel  retired  Martin  Nehring  is  admitted. 

Prosecution  Exhibit  113  Ms.   Debra  van 
Alstyne  is  admitted. 

Prosecution  Exhibit  115  Mr.   White  Bora 

is  admitted. 

Prosecution  Exhibit  116,   Mr.  Patrick 
Hoeffell  is  admitted. 

Prosecution  Exhibit  117,    CW5  John  LaRue 

is  admitted. 

And  Prosecution  Exhibit  119 
Mr.    Jacqueline  Scott  is  admitted. 

Let  the  record  reflect  I'm  handing  all 
of  those  exhibits  back  to  the  court  reporter. 

Is  there  anything  that  we  need  to 
address  before  we  proceed? 

MAJOR  FEIN:     No,   Your  Honor. 

MR.   HURLEY:     No,  ma'am. 

THE  COURT:      Call  your  next  witness. 

CAPTAIN  MORROW:      Call  Special  Agent  Mark 
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Mander . 
Whereupon, 

MARK  MANDER, 

called  as  a  witness,   having  been  first  duly  sworn  to 
tell  the  truth,    the  whole  truth  and  nothing  but  the 
truth,   was  examined  and  testified  as  follows: 

DIRECT  EXAMINATION 

Q  You  are  Special  Agent  Mark  Mander? 

A  Yes . 

Q  Investigate  unit    (INAUDIBLE)  CID? 

A  Yes . 

Q  Agent  Mander,    how  long  have  you  been  with 

CID? 

A  I've  been  an  agent  approximately  11  years. 

Q  And  you  are  a  civilian  agent  at  this  time? 

A  Yes,    I'm  a  civilian  agent  currently. 

Q  And  describe  your  career  at  CID? 

A  Beginning  in  1994   I  became  a  CID  agent  as 

military  or  active  duty  CID  agent,   was  a  military  agent 
for  about  four  years,   went  to  the  Reserves  for  three 
years .      I  then  took  a  break  from  both  reserves  or  any 


Provided  by  Freedom  of  the  Press  Foundation 


1 

2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 


UNOFFICIAL  DRAFT  -  6/10/13  Afternoon  Session 


21 

military  service  to  join  the  Reserves  again  in  2007, 
and  then  in  2008  I  became  a  civilian  agent  and  was  also 
a  reserve  agent  at  the  same  time. 

Q  When  did  you  joint  CCIU  specifically? 

A  I  was  hired  as  a  civilian  agent  in  CCIU  in 

February  of  2008. 

Q  And  what  training  did  you  have  to  become  a 

CID  agent? 

A  I  think  in  1994   I  went  to  basically  the  CID 

school  where  they  teach  various  aspects  of  being  an 
agent . 

Q  And  what  training  have  you  received  related 

to  computer  crimes  as  part  of  your  CCIU  job? 

A  Basically  all  the  agents  at  CCIU  go  through 

various  training  courses  at  the  defense  cyber 
investigations  training  academy,    (INAUDIBLE).  I've 
attended  approximately  over  400  hours  of  courses  there. 
The  courses  range  from  identifying  various  computer 
parts  and  software,   doing  analysis  of  computers 
imagining  or  obtain  forensic  imaging  of  computers, 
things  of  that  nature . 
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Q  What  is  CCIU's  area  of  expertise  in  the 

CCIU  world? 

A  CCIU  is  Army  CID ' s  investigative  element 

that  is  specifically  focused  on  conducting 
investigations  involving  computer  intrusions  and 
computer  crimes . 

Q  And  what  do  you  mean  by  an  intrusion? 

A  Essentially  there  are  many  instances  or 

incidents  where  Army  or  DoD  computer  networks  are 
intruded  upon  where  someone  will  remotely  try  to  get 
access  or  does  gain  access  and  obviously  that  is  a 
crime  that  we  investigate . 

Q  And  do  you  hold  any  certifications  in 

computer-related  fields? 

A  Currently  I  hold  a  Department  of  Defense 

certificate  computer  crime  investigator  certification. 

Q  And  approximately  how  many  cases  have  you 

investigated  in  the  as  a  CCIU  agent? 

A  Probably  in  excess  of  20 . 

Q  And  what  about  total  in  CCIU,    how  many 

cases  have  you  vetted? 
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A  Probably  in  access  of  200  cases  where  I  was 

the  primary  agent  or  I  was  helping  another  agent  on 
their  case . 

Q  I'd  like  to  discuss  the  investigation  of 

PFC  Manning  at  Wikileaks .     What  has  been  —  or  what  has 
your  role  been  in  the  investigation  to  date? 

A  When  the  investigation  first  started 

essentially  I  was  a  case  agent  in  the  investigation 
which  means  I  would  do  various  case  related 
investigative  duties. 

Q  And  how  did  this  investigation  compare  to 

other  investigations  you've  been  a  part  of  at  CCIU? 

A  For  CCIU  as  well  as  all  of  the  other 

investigations  that  I've  participated  as  a  CCIU  agent. 
This  was  probably  one  of  the  largest  and  most 
complicated  investigations  we've  ever  had. 

Q  As  a  case  agent,   what  were  you  doing 

day-to-day  ? 

A  My  duties  involved  reviewing  various 

documents,  either  classified  documents  or  open— source 
documents,    interviewing  personnel  that  had,   you  know, 
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some  relationship  or  bearing  on  the  investigation, 
writing  reports,    collecting  evidence,    coordinating  with 
various  other  agencies  and  other  personnel  to  forward 
the  case . 

Q  And  what  initially  brought  PFC  Manning  to 

law  enforcement ' s  attention? 

A  Initially  in  —  towards  the  end  of  May  of 

2010  our  office  received  an  e-mail  that  suggested  a 
soldier  in  Iraq  had  or  was  or  would  be  wrongfully 
disclosing  classified  information. 

Q  And  what  organization  was  initially 

responsible  for  the  investigation? 

A  Initially  it  was  Army  CID  was  involved.  It 

wasn't  the  CCIU  initially.     The  case  was  opened  by  a 
CID  office  in  Iraq  that  was  assigned  the  case. 

Q  And  when  did  the  case  get  transferred  to 

CCIU? 

A  I'm  going  to  say  probably  the  second  week 

of  June,    I  believe  it  was  maybe  the  9th  or  10th  of  June 
or  somewhere  thereabouts . 

Q  Aside  from  the  computer  access,   why  was  the 
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case  transferred  to  CCIU  in  your  office  specifically  in 
the  United  States? 

A  Well,   there  were  several  reasons  aside  from 

kind  of  computer  aspects  even  when  the  investigation 
was  with  the  office  in  Iraq.      It  was  pretty  much 
understood  that  CCIU  would  conduct  the  computer 
forensics  related  to  the  case,   but  as  the  case 
developed  we  started  to  understand  that  there  was  going 
to  be  most  likely  a  lot  of  commercial  providers  and/or 
other  places  within  the  United  States  that  we  would 
have  to  get  evidence  from  such  as  log  files  and  things 
of  that  nature . 

Typically  in  a  case  where  we  have  to  deal 
with  commercial  providers  like  say  Google  or  Microsoft 
of  the  —  typically  to  compel  them  to  provide  evidence 
to  us.     We'll,   get  a  federal  magistrate  search  warrant, 
and  a  federal  magistrate  with  something  that  was  not 
available  in  Iraq.      They  don't  have  a  federal 
magistrate  over  there.     So  that  was  another  reason  that 
the  case  was  transferred  to  us . 

Q  Now,    does  CCIU  itself  work  with  the 
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assistant  U.S.   attorneys  and  federal  magistrates  often? 
A  Yes,   very  often,   because  — 

MR.   TOOMAN:     Objection,    Your  Honor. 

Relevance . 

THE  COURT :     Overruled . 

THE  WITNESS:     We  work  with  assistant  U.S. 
attorneys  and  federal  magistrates  very  often. 
Generally  because  when  a  computer  intrusion  incident 
occurs  a  lot  of  times  it ' s  not  apparent  what  the  source 
of  that  intrusion  is  and,   therefore,    it's  not  always  a 
soldier,   therefore,   we  wouldn't    (INAUDIBLE)    SJ  or  a 
trial  counsel  initially. 

BY  MR.  MORROW: 

Q  Other  than  the  source,    sort  of  the  need  to 

interact  with  the  commercial  providers  in  order  to 
obtain  search  authorizations,    any  other  reasons  why  the 
case  was  better  suited  for  or  why  the  case  was 
transferred  to  CCIU  in  the  United  States? 

A  We  discussed  the  obviously  computer  aspect 

of  it .     The  fact  that  there  would  be  federal 
magistrates  most  likely  involved  to  compel  the 
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commercial  providers.     There  was  also,   you  know,  maybe 
not  so  obviously,   but  personnel  within  the  United 
States  that  knew  Manning  as  well  as  we  also  developed 
there  was  indications  that  there  was  persons  that  he 
had  met  with  or  had  been  in  contact  with  in  the  Boston 
area  during  or  before  his  time  in  Iraq  as  well  as 
during  the  time  he  was  on  leave. 

Q  And  how  did  the  evidence  get  from  Iraq  to 

the  United  States? 

A  There  was  —  initial  evidence  was  collected 

in  Iraq  that  basically  the  agents  there  had  collected 
and  that  evidence  was  brought  from  Iraq  via  one  of  the 
these  agents  who  was  going  on  leave  who  hand  carried 
the  evidence  with  him  from  Iraq  to  the  Washington,  D.C. 
area  and  I  met  him  in  the  airport . 

Q  You  met  him  at  the  airport? 

A  I  did  what  that  was  that . 

THE  COURT:     What  airport? 
BY  MR.  MORROW: 

Q  What  airport  was  that? 

A  Does  the  Dulles  International  Airport . 
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Q  And  when  approximately  was  that? 

A  I  would  have  to  look  at  the  evidence 

documents  it  would  probably  sometime  in  the  second  week 
of  Julian  right  about  there  I  believe. 

Q  And  once  you  met  that  the  agent  at  Dulles 

what  did  you  do  next? 

A  We  basically  invented  the  items  that  he  had 

hand  carried  pertain  evidence  vouchers  that  he  also  had 
and  then  I  signed  footer  items  and  then  I  hand  cared 
them  to  our  evidence  room  at  CCIU. 

Q  And  once  the  evidence  was  in  the  unit  the 

states  how  did  the  investigation  progress  from  a  there? 

A  Initially  we  looked  at  various  pieces  of 

evidence .      The  forensic  team  of  CCIU  began  examining 
the  evidence  that  had  been  received  as  well  as  evidence 
that  had  been  collected  in  other  places  and  based  on 
the  examination  of  that  evidence . 

The  forensic  team  would  then  a  —  the 
investigative  team  to  lead  or  investigative  matters 
that  needed  to  be  followed  up. 

Q  And  at  this  point  when  the  evidence  was 
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transferred,   was  the  case  very  well  developed? 

A  No,   the  case  was  just  developing 

essentially . 

Q  And  what  were  you  —  what  were  the  cases 

using  to  track  down  leads?     What  was  being  revealed  by 
the  examinations  by  the  forensic  examiners? 

A  Well,    for  example,   on  some  of  the  digital 

media  that  was  collected  in  Iraq  that  I  believe  there 
were  chat  logs  between  PFC  Manning  and  Mr .   Lamo  that 
were  correspond  to  do  chat  logs  between  Mr .   Lamo  and 
PFC  Manning  from  digital  media  that  is  what  collected 
from  Mr.  Lamo. 

So  looking  at  those  chat  logs  as  well  as 
other  information  that  was  contained  on  the  digital 
media  that  is  what  going  examined  such  as  there  was  I 
mean  from  PFC  Manning  I  believe  it  was  his  personal 
computer  those  items  of  information  that  were  you  know 
in  those  digital  media  items  created  invest  leads  to 
identify  certain  people  to  interview  them. 

Q  And  what  did  the  chat  logs  reveal  regarding 

sort  of  the  scope  of  the  alleged  translations  or 
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compromising  information? 

CAPTAIN  TOOMAN:     Objection,    Your  Honor.  I 
mean,   the  chat  log. 

MR .   MORROW :      I'm  asking  a  very  general 
question,    Your  Honor,    to  add  to  his  testimony. 

THE  COURT :     Are  you  going  to  go  down  and 
(INAUDIBLE)    as  before.  Overruled. 

THE  WITNESS:      Can  you  repeat  the  question, 

sir? 

BY  MR.  MORROW: 

Q  What  was  revealed  in  the  chat  logs  that 

provided  sort  of  context  to  the  compromise  or  the 
alleged  compromises  of  information? 

A  I'm  not  following,  sir. 

Q  Who  was  the  recipient  of  information 

allegedly  comprised  by  PFC  Manning? 

A  According  to  the  chat  logs  and  other  next 

it  appeared  that  the  organization  Wikileaks  was  the 
recipient  of  information. 

Q  And  what  is  Wikileaks? 

A  Wikileaks,    to  my  knowledge,    is  a 
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organization  which  its  mission  is  to  obtain  and 
publicly  display  or  public  documents  from  governments 
and  other  private  organizations. 

Q  And  when  did  the  Wiki leaks  organization 

become  widely  known? 

A  It  was  probably  widely  known  following  the 

disclosure  of  a  video  involving  U.S.   Army  helicopter 
involved  in  combat  operation. 

Q  And  what  was  released  during  that  —  what 

was  the  release  essentially  can  you  describe  what  was 
released  by  Wikileaks? 

A  It  was  on  April  5th  of  2010  Wikileaks  or 

members  of  Wikileaks  held  a  press  conference  type  of 
event  where  they  displayed  and/or  published  an  edited 
version  of  a  video  taken  from  an  Army  helicopter 
involved  in  a  combat  operations. 

Q  What  do  you  mean  by  an,   edited  video? 

A  Some  my  knowledge  the  video  was  edited  from 

the  original  video . 

CAPTAIN  TOOMAN:     Objection,    Your  Honor. 
This  witness  has  no  personal  knowledge  of  any  editing 


Provided  by  Freedom  of  the  Press  Foundation 


1 

2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 


UNOFFICIAL  DRAFT  -  6/10/13  Afternoon  Session 


32 

on  the  video . 

THE  COURT:     Does  he? 
BY  CAPTAIN  MORROW: 

Q  Agent  Mander,    are  you  familiar  with  the 

video,   the  Apache  video?     Have  you  seen  the  Apache 
video  in  its  full  form  as  part  of  this  investigation? 

A  I  don ' t  remember  having  seen  the  original 

video,   but  I  know  from  looking  at  the  version  that  was 
released  by  Wikileaks,    it  had  been  edited  because  there 
was  certain  information  that  wouldn ' t  have  been 
contained  in  the  original  such  as  names  of  some  of  the 
personnel  that  was  casualties  in  the  video . 

Q  And  you  said  the  Wikileaks  organization,  is 

it  a  website  you  said  it  publishes  information?  How 
does  it  publish  information? 

A  The  Wikileaks  organization  has  a  website. 

The  domain  name  is  Wikileaks.org,    or  ORG,    and  they  also 
have  several  other  we  call  them  mirror  websites  that 
contain  generally  the  same  content  as  the  main  site . 

Q  What  do  you  mean  by  a,   mirror  website? 

A  When  I  say  mirror  I  mean  that  there  were 
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additional  websites  using  other  domain  names  that 
appear  to  have  been  hosted  physically  in  other 
countries  or  other  jurisdictions  I  guess  you  could  say 
that  would  contain  the  same  content  as  the  main  site 
and  presumably  with  the  intent  so  that  if  the  main  site 
was  ever  taken  down  by  some  type  of  government  order 
or  — 


this  witness  would  have  no  knowledge  of  why  it  would  be 
multiple  sites. 

THE  COURT:      Sustained  unless  there  was  a 

foundation . 

BY  MR.  MORROW: 


CAPTAIN  TOOMAN:     Objection,    Your  Honor, 


Q 


Do  your  knowledge,   Agent  Mander,    is  the 


Wikileaks  website  still  active? 


A 


It's  still  active. 


Q 


And  who  can  access  the  website? 


A 


Any  member  of  the  general  public . 


Q 


Who  was  the  public  face  or  leader  of  the 


Wikileaks? 


A 


There  is  a  Mr.    Julian  Assange  is  kind  of 
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the  self —described  leader  or  editor  of  Wikileaks . 

Q  Agent  Mander,    I  want  to  talk  about  the 

structure  of  the  organization  when  it  came  back  to  the 
United  States .     Outside  of  CCIU,   what  other 
investigative  organizations  were  involved  in  the 
investigation  of  PFC  Manning? 

A  Initially  the  Department  of  State 

Department  in  particular,    or  DSS,   was  involved  in 
investigating  the  compromise  and/or  unlawful  disclosure 
of  a  I,   believe  it  was  a  diplomatic  cable  relating  to 
information  involving  Iceland,    and  that  had  occurred 
several  months  before  CID  was  involved  in  the 
investigation . 

Q  And  other  than  the  DSS  what  other 

organizations  were  involved? 

A  Initially  when  we  received  information  from 

or  should  I  say  that  information  was  developed  about  a 
son— in— law?     Iraq  possibly  unlawfully  disclosing 
information  Army  military  intelligence  was  also 
involved  because  efficiently  there  was  a  concern  that 
possibly  foreign  intelligence  service  could  be  involved 
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as  well  as  the  state  department  and  Army  military 
intelligence . 

Q  Any  federal  law  enforcement  authorities? 

A  Later,   probably  in  late  June  or  maybe  July 

the  FBI  also  became  involved. 

Q  What  was  the  status  of  the  investigation  or 

did  the  various  investigative  organizations,   were  they 
working  together? 

A  Yes,    they  we  call  it   joint  investigation 

and  what  that  means  is  that  the  investigative  agents 
each  determine  that  they  will  work  together  and 
typically  they  will  define  kind  of  investigative  leads 
specific  to  that  agency's  interest  that  they  will 
pursue . 

Q  And  what  was  CCIU's  claim  essentially? 

A  CCIU  was  to  investigate  all  Army  and/or  DoD 

related  investigative  leads . 

Q  And  what  was  the  FBI ' s  link? 

A  The  FBI  this  would  be  investigating  any 

(INAUDIBLE)    leads  that  didn't  really  have  like  a 
Department  of  Defense  or  Army  and/or  nexus . 


Provided  by  Freedom  of  the  Press  Foundation 


1 

2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 


UNOFFICIAL  DRAFT  -  6/10/13  Afternoon  Session 


36 

Q  Generally  did  the  investigative 

organizations  share  information? 
A  Yes. 

Q  And  what  about  investigative  activities, 

did  the  various  organizations  stay  in  their  lane  or  did 
you  all  do,   conduct  investigative  activities  together? 

A  Yes .      There ' s  numerous  instances  such  as 

various  interviews  that  were  done  jointly.      So,  for 
example,   there  was  at  least  one  interview  that  I 
conducted  where  there  was  CID  Army  and/or  military 
intelligence  as  well  as  the  DSS  agents  participated  in 
the  interview . 

Q  And  as  part  of  this  investigation 

approximately  how  many  individuals  have  you 
interviewed? 

A  I  would  have  to  go  back  and  look  at  the 

case  file,   but  I  would  say  probably  at  least  25  or 
more . 

Q  And  are  you  familiar  with  agents 

investigative  reports? 

A  I'm  familiar,  yes. 
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Q  And  approximately  how  many  reports  have  you 

filed  as  part  of  this  investigation? 

A  Again,    I'd  have  to  review  the  case  file, 

but  I  would  say  probably,   probably  in  access  of  at 
least  50. 

Q  I  want  to  talk  about  some  other 

investigative  activity  that  CCIU  conducted  in  relation 
to  this  case.     As  part  of  the  investigation,    did  CCIU 
preserve  or  collect  information  that  was  posted  on  the 
Wikileaks  website? 

A  It  at  various  points  I  believe  there  was 

agents  that  were  assigned  to  download  information  that 
was  published  on  the  Wikileaks  website  because  it 
contained  classified  information  and  was  otherwise 
evidence . 

Q  And  what  would  be  the  benefit  of  collecting 

information  from  there?     How  was  that  information  used? 

A  The  information  that  was  collected  from  the 

Wikileaks  website  would  be  used  for  comparison  purposes 
to  information  that  may  be  found  on  digital  media  that 
was  collected  in  the  case  from  various  cases,  from 
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various  sources . 

CAPTAIN  TOOMAN:      I  will  object  to  their 
line  of  questioning  the  witness  said  that  other  agented 
are  the  ones  that  downloaded.     So  it's  not  his  personal 
knowledge . 

MR.   MORROW:     Your  Honor,    I  think  I've 
established  his  personal  knowledge  of  the  entire 
investigation . 

THE  COURT :     Overruled . 
BY  MR.  MORROW: 
Q  Is  that  a  typical  investigative  activity 

for  CCIU? 

A  What  — 

Q  Preserving  and  collecting  information  in 

websites . 

A  In  some  cases,  yes. 

Q  Now,   based  on  your  knowledge  and 

experience,   are  there  ways  to  observe  a  website  as  it 
appeared  on  a  certain  date? 

A  There  are  certain  tools  that  would  allow 

you  to  see  what  a  website  looked  previously. 
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Q  And  what  are  some  of  those  tools? 

A  One  tool  that  we  will  so  occasionally  use. 

It's  a  website  that  uses  the  domain  name  icon.org  and 
it  also  has  a  nickname .     We  call  it  the  wayback 
machine . 

Q  And  are  there  any  other  ways  that  you  might 

observe  a  website  as  it  appeared  at  a  certain  date 
prior? 

A  I  know  that  Google  is  also  a  potential 

source  Google  as  it  looks  at  websites  to  catalog  them 
for  search  results  that  sometimes  saves  a,   what  we 
call,   a  cached  version  of  that  website. 

Q  Can  you  explain  how  an  agent  or  how  would 

you  use  Google  cache  to  see  how  a  website  may  appear  on 
a  certain  day? 

A  Well,    for  example,    some  of  what  recently  I 

was  searching  for  a  particular  term  to  see  if  I  could 
find  something  and  sometimes  especially  DoD  computer 
networks  may  be  blocked  from  going  to  certain  websites 
because  of  either  the  nature  of  the  website  or 
sometimes  make  a  key  word  such  as  something  involving 
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something  sexual  will  be  automatically  blocked  through, 
you  know,  filtering. 

So  to  get  around  this  issue  sometimes  you 
can  look  at  the  Google  cached  version  and  get  an  idea 
of  what  the  website  that  you're  looking  for  looks  like. 

Q  How  would  you  access  the  Google  cache 

version  versus  the  website  that's  being  blocked?  How 
does  it  appear  to  you  on  the  screen  when  you  are 
accessing  the  Google  cache    (INAUDIBLE) ? 

A  Generally  you  put  your  search  terms  in  the 

Google  website  would  you  hit  search  and  you  would  then 
receive  results,   and  then  typically  there  is  —  it 
depends  on  what  time  or  era  we're  talking  about,  but 
right  now  presently  there's  like  a  little  arrow  next  to 
the  one  of  search  results  and  then  you  can  choose  to 
see  the  cache  version  versus  the  actual  version. 

Q  And  the  cache  version,    does  it  indicate 

that  date  that  the  website  was  saved  or  downloaded  or? 

A  Typically  when  you  view  the  cached  version 

at  the  top  portion  of  the  version  that  you'll  see  it 
will  say  something  to  the  effect  of,   this  is  Google's 
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version  of  this  website  on  whatever  date  and  time,  and 
it  also  will  give  you  a  caveat  that  the  website  may 
have  changed  since  then. 

Q  And  you  mentioned  the  Internet  archive  or 

archive.org,    can  you  explain  how  you  might  use  that  to 
observe  a  website  in  the  past? 

A  That  tool  is  little  more  comprehensive . 

Q  First  let's  start  with  this  then.     What  is 

the  Internet  archive  or  archive . org? 

A  It ' s  a  website  that  was  established.  It 

seemed  to  be  funded  by  some  type  of  nonprofit 
organization  that  their  goal  is  to  catalog  websites  on 
the  Internet,    amongst  other  things. 

So  what  they're  website  does  is  it  appears 
to  periodically  go  out  and  download  the  content  of 
websites  and  then  it  saves  them  for  retrieval  by  the 
general  public  that  want  to  use  or  see  what  a 
particular  site  looked  like  in  the  past . 

Q  Now,    in  your  experience  as  an  agent,  have 

you  used  the  Internet  archive  or  archive . org  to  see  how 
a  website  might  have  looked  in  the  past? 
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A  Yes.     There's  been  occasions  where  we  have 

been  site,    involved  an  investigation  may  have  been 
taken  down  by  the  time  that  we  want  to  look  at  it  and 
thereafter  we  would  like  to  see  when  it  previously 
looked  like  and,   therefore,   we  might  use  that  tool  as  a 
way  to  see  what  a  website  looked  like  in  the  past. 

Q  So  take  me  through  how  you  might  use  the 

Internet  archive  or  archive.org  and  describe  from  the 
beginning  and  we ' 11  try  to  go  through  is  this  slowly? 

A  Assuming  that  you  have  a  web  browser  and 

computer  connected  to  the  Internet,   would  you  open  up 
the  web  browser  window,   you  would  navigate  to  the 
archive . org  website . 

On  that  website  there  is  a  place  we  can 
enter  in  text  of  what  you  want  to  see .     So  you ' d 
presumably  put  in  the  address  or  uniform  resource 
locater  code  for  the  websites  that  you're  interested 
in . 

You  would  then  hit  a  search  button  at  which 
point  if  the  website  has  been  achieved  or  cataloged 
within  archive . org  you  would  be  shown  something  that 
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resembles  like  a  calendar  and  that  calendar  will  have 
little  circles  for  days  that  it  captured  of  the  website 
that  you've  typed  in  has  been  archived  at  which  point 
you  can  then  click  on  the  little  circles  and  see  that 
version  of  that  website  that  has  been  archived. 

Q  And  it ' s  that  version  of  that  website 

that ' s  linked  to  a  date? 

A  Yes .     There  will  be  like  a  date  and  time 

sometimes  some  websites  are  cataloged  archived  more 
than  once  per  day. 

Q  Now,   once  you've  clicked  on  that  date,  what 

happens  ? 

A  Typically  the  website  for  the  day  and/or 

time  that  you've  clicked  on  will  then  display  and  you 
will  see,   generally  speaking,   what  that  website  looked 
like  on  that  day  and  time. 

Q  Now,    if  you  printed  that  web  page  from  the 

Internet  archive,   what  would  happen? 

A  If  you  printed  that  page  you  would  get  a 

printout  of  generally  what  was  on  the  screen,  and 
depending  on  the  browser  settings,   most  browsers  have 
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the  ability  to  include  the  thing  you've  printed,  the 
address  of  the  website  as  well  as  the  date  and  time  and 
maybe,    say,    like  the  number  of  pages  and/or  the  total 
of  the  website. 

Q  I'm  retrieving  what's  been  marked  as 

Prosecution  Exhibit  109  for  identification. 
THE  COURT:  Proceed. 

CAPTAIN  TOOMAN:      The  defense  requests  the 
opportunity  to  voir  dire  this  witness  about  his 
knowledge  of  the  that  machine  or  archive.org,    how  it 
functions . 

THE  COURT:     With  the  goal  of  venting 
visibility  of  this  exhibit . 

MR.   COOMBS:      I  would  object  to  foundation, 
personal  knowledge  of  this  witness  and  I'd  like  to  voir 
dire  in  light  of  that  objection. 

THE  COURT :      Let  me  see  the  exhibit .  Why 
don ' t  we  do  this  again .      I  have  two  roles  here .     One  of 
them  as  the  military  judge,   that  would  be  in  every 
case,    for  motions  to  decide  the  legality  or  nonlegality 
of  something  coming  in . 
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In  that  role  I  will  allow  that 
government  at  least,   at  this  point,   to  go  forward 
with  the  questions  on  what  their  foundation  would  be 
with  respect  to  admitting  this  exhibit  and  then  I ' 11 
allow  the  defense  to  voir  dire  the  witness  and 
decide  your  objections . 

Should  I  rule  in  favor  of  the  defense 
and  not  of  this  exhibit,    (INAUDIBLE)    does  that  make 
sense? 

MR.   COOMBS:     Yes,    Your  Honor. 

MR.   MORROW:     Yes,    Your  Honor. 

THE  COURT:     Proceed.     Let  me  see  what  that 
exhibit  is  first . 

BY  MR.  MORROW: 
Q  I'm  handing  the  witness  what's  been  marked 

as  Prosecution  Exhibit  109  for  identification. 

Do  you  remember  that  document,  Agent 

Mander? 

A  I  do. 

Q  And  what  is  it? 

A  In  appears  to  be  a  version  of  the  most 
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wanted  leaks  of  2009  list  that  was  obtained  from  the 
archive . org  website . 

CAPTAIN  MORROW:     Permission  to  publish  to 
the  Court,    Your  Honor. 

THE  COURT:  Proceed. 

BY  CAPTAIN  MORROW: 
Q  Agent  Mander,    I  want  to  focus  mainly  on 

sort  of  the  bottom  of  this  page,    specifically  the  line 
at  the  very  bottom  that  starts  with  HTTP://. 

Do  your  see  that? 
A  Yes . 

Q  Can  you  explain  just  by  looking  at  that 

line  what  this  web  image  or  what  this  printout  shows  or 
what  exactly  that  means  down  at  the  bottom? 

A  As  I  mentioned,   when  you  print  a  document 

using  your  web  browser  various  web  browsers  will  allow 
you  to  include  in  the  header  or  footer  of  what  you ' re 
printing.      Information  such  as  the  URL  of  the  document 
you're  printing. 

So,    for  example,   based  on  this  footer  here, 
this  would  be  a  document  that  was  printed  from  the 
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address  that ' s  listed  there  that  starts  with  the 
HTTP://  (INAUDIBLE) 

Q  What  are  the  numbers .      It  says  /  and  then  a 

web  again?     What  are  the  numbers  to  the  right  starting 
with  2009?     What  does  that  indicate? 

A  As  far  as  my  knowledge,   that  would  be  the 

date  and  the  time  of  the  capture  of  the  website  which 
follows  after  the  numbers  the  HTTP : //Wikileaks . org . 

Q  And,   again,   what  does  it  say  at  the  end 

after  Wikileaks.org? 

A  /wiki /draft :v_   (INAUDIBLE)    and  then  it 

looks  like  the  whole  URL  is  too  long    (INAUDIBLE) .  The 
dots  kind  of  indicate  there's  more. 

Q  Now,    as  part  of  this  case,   Agent  Mander, 

have  you  had  the  opportunity  to  see  whether  the  website 
still  exists  even  outside  of  using  the  archive.org? 

A  The  Wikileaks? 

Q  The  Wikileaks  website,   and  specifically  the 

2009  draft.     The  website  you  just  looked. 

MR.   TOOMAN:     Objection.     Relevance  of  what 
Wikileaks.org  looked  like  today.     Not  relevant,  Your 
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Honor . 

THE  COURT:     Where  are  you  going  with  this? 

CAPTAIN  MORROW:     Your  Honor,   between  what 
how  it  looked  in  the  past  and  how  the  website  still 
appears  today,    (INAUDIBLE) . 

THE  COURT:     You're  asking  this  witness  if 
this  witness  can  find  that  document  today? 

CAPTAIN  MORROW:     Yes,  exactly. 

THE  COURT :      That ' s  overruled . 

BY  CAPTAIN  MORROW: 
Q  Agent  Mander,   please,    explain  how  you  would 

find  this  document  or  this  web  page  today? 

A  That  particular  document  I  believe  I  used 

some  key  words  and  conducted  a  search  using  Google,  and 
one  of  the  first  or  maybe  one  of  the  first  full  results 
was  that  document  that  is  actually  or  was  on  the 
Wikileaks  website  as  of  just  a  couple  of  weeks  ago. 

Q  I'm  going  to  show  you  what ' s  been  marked  as 

Prosecution  Exhibit  110  for  identification. 

THE  COURT :     Are  you  going  to  have  the  same 
objections  to  this  one? 
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CAPTAIN  TOOMAN:      Can  I  see  it,    Your  Honor? 
Can  I  have  a  moment,   Your  Honor? 
THE  COURT :     Yes . 

CAPTAIN  TOOMAN:       (INAUDIBLE) . 
BY  CAPTAIN  MORROW: 
Q  Agent  Mander,    I'm  handing  you  what's  been 

marked  as  Prosecution  Exhibit  110  for  identification. 
Can  you  take  a  look,  please? 
A  (Witness  reviewing  document.) 

Q  Do  you  recognize  that  document? 

A  Yes  this  is  a  document  similar  to  the  one 

that  you  just  showed  me.      It  is  a  version  that  you 
would  find  in  the  Wikileaks.org  website  as  of  June  1st. 
Q  And  how  do  you  know  that? 

A  I  went  to  the  site  and  printed  out  this 

document  and  where  I've  initialed  the  bottom  above  the 
date  and  time  on  each  page. 

Q  How  was  that  document  created?     You  created 

it? 

A  I  printed  it,  yes. 

CAPTAIN  MORROW:     Permission  to  publish  to 


Provided  by  Freedom  of  the  Press  Foundation 


1 

2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 


UNOFFICIAL  DRAFT  -  6/10/13  Afternoon  Session 

50 

the  Court ,    Your  Honor . 

THE  COURT:  Proceed. 

BY  CAPTAIN  MORROW: 
Q  Agent  Mander,    how  is  this  web  page 

organized? 

A  From  generally  speaking,    it  looks  like  — 

Q  Do  you  need  the  exhibit  back? 

A  Sure . 

At  the  top  of  the  document  it  says  the  word 
draft  coal  the  most  wanted  leaks  2009— sort  and 
generally  speaking  below  that  there  is  somewhat  of  like 
a  table  of  contents  which  are  links,   and  each  of  the 
links  represents  the  various  countries  in  alphabetical 
order  to  include  like  a  miscellaneous  category  of 
international  organizations  and  then  below  that  are 
listed  various  countries  and  below  each  country  appears 
to  be  a  list  of  documents  or  other  information. 

Q  Does  the  United  States  appear  on  that  list? 

A  The  United  States  does  appear  on  this  list . 

Q  And  what  page  is  that? 

A  It  begins  on  page  9  and  appears  to  go  to 
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page  11 . 

CAPTAIN  MORROW:     Your  Honor,   permission  to 
publish  page    (INAUDIBLE)    to  the  Court. 

THE  COURT:  Proceed. 
BY  CAPTAIN  MORROW: 
Q  Agent  Mander,    at  this  time,    I'd  like  you  to 

move  to  the  panel  box,   please,    if  you  would? 
A  What ' s  the  panel  box? 

Q  Right  here . 

I ' m  handing  Agent  Mander  what ' s  been 
admitted  as  Prosecution  81.     Mr.   Mander,   Agent  Mander, 
I'd  like  you  to  scroll  down  to  28  November  in  that 
Exhibit . 

A  Okay . 

Q  And  I'd  like  you  to  look  at  lines  27 

through  33 . 

A  (Witness  reviewing  document . ) 

Okay . 

Q  The  last  27  to  33,   what  do  they  say? 

A  The  whole  line  or  just  the  action? 

Q  The  action  line,  please. 
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A  From  line  27  the  action  column  reads 

retention  plus  sign  of  plus  sign  interrogation  plus 
sign  videos . 

Q  On  this  list  found  on  this  website,    do  you 

see  any  similar  information? 

A  Move  on  up  to  the  top  of  the  document . 

Q  Let  me  help  you .     Do  you  see  anything  under 

military  intelligence? 

A  On  the  second  bullet  there ' s  a  CI  detainee 

interrogation  news,    it  appears  there. 

Q  And,    again,    like  for  you  to  scroll  to  that 

what  you're  looking  at.      Scroll  to  lines  114  and  115, 
please . 

A  Okay . 

Q  What  do  you  see?     What's  the  action  there? 

What's  the  information? 

A  Line  114  reads,    interrogation  plus  tapes 

and  line  115  it  reads,    interrogation  plus  video. 

Q  Agent  Mander,    now,    I'd  like  to  go  back  to 

2  9  November  please  and  lines  43  and  44  specifically. 

A  Okay . 
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Q  And  have  you  found  that? 

A  I  have . 

Q  What  are  the  lines,   what  do  those  reads? 

A  The  action  column  it  reads,    detainee  plus 

abuse  and  that's  for  33,   and  line  44  is  the  same 
detainee  plus  abuse . 

Q  And  does  similar  information  exist  on  the 

military  tory  intelligence  of  this  web  page? 

A  On  the  fourth  bullet  the  words  detainee 

abuse  photos,   withhold  by  the  Obama  administration. 

Q  I'd  like  to  go  to  30  November,    line  62. 

A  Okay . 

Q  And  what  does  that  line  read? 

A  The  action  column  also  reads,   detainee  plu 

abuse . 

Q  Now,    I  want  you  to  go  to  a  serious  of 

searches  starting  to  8  December.      I'm  looking 
specifically  at  —  if  you  could  refer  to  lines  100 
through  111. 

A  Line  100,    the  action  column  reads, 

Guantanamo  plus  detainee  plus  operations . 
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Q  Read  all  of  them  down  to  111. 

A  The  next  line  JTF  plus  GTMO .      The  next  line 

is  JTF  plus  GTMO  plus  SOP .     Next  line  is  CJTF  plus  82 
plus  detainee  plus  SOP .     Next  line  is  CJATF  plus  82 
plus  detainee  plus  plus  operations.     Next  line  is  JTF 
plus  GTMO  plus  SOP  plus  interrogation.     Next  line  is 
CJTF  plus  101 .     Next  line  is  JTF  plus  GTMO  plus  SOP 
plus  interrogation. 

The  next  line  is,    SOP  plus  interrogation. 
The  next  line  is,    JTF  plus  GTMO.      The  next  line  is  JTF 
plus  GTMO  plus  SOP .      The  next  line  is  JTF  plus  GTMO 
plus  Delta  plus  SOP.      The  next  line  is,    human  plus 
rights  plus  campaign. 

Q  First  what ' s  SOP  mean  to  you  as  somebody 

who ' s  been  in  the  military? 

A  Generally  that ' s  an  abbreviation  for  an 

acronym  for  standard  operating  procedure. 

Q  And  what  does  delta  mean  to  you  in  the 

context  of  these  searches? 

A  I  would  assume  that  would  be  (INAUDIBLE) 

which  is  a  portion  of  Guantanamo  Bay  and  the  detainee 
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facility  there. 

Q  A  those  lines  100  through  111,    is  any 

similar  information  or  items  appear  in  this  list  here. 
I ' 11  give  you  a  moment .      I  would  ask  you  just  to  review 
all  the  way  down .     When  you  see  something  that  catches 
your  eye,   please,   let  me  know. 

A  (Witness  reviewing  document . ) 

On  the  seventh  bullet  use  the  word  Camp 
Delta      (INAUDIBLE)    Delta    (INAUDIBLE)  Guantanamo 
standard  operating  procedure  2005,    2009.      To  bullets 
below  that  is  the  words  unredacted  inquiry  into 
treatment  of  detainees  and  U.S.   custody  20 
November  2008.     A  few  bullets  below  that  is  the  words 
Camp  Delta  Guantanamo  standard  operating  procedure 
2005,    2009.     Below  that  is  Camp  Delta  Guantanamo 
interrogation  versus  operation  procedure  2003-2009,  and 
it  appears  to  be  all  what  I  see. 

CAPTAIN  MORROW:     Your  Honor,    at  this  time 
prosecution  moves  109  and  110  and. 

THE  COURT:      I'm  going  to  allow  it.     Are  you 

finished? 
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CAPTAIN  MORROW:     No,    no,    I'm  not,  actually. 
I  have  a  few  more  questions  to  go  through  regarding 
different  exhibits  but  I  can  stop  now,    if  you  like. 

THE  COURT:  Why  don't  we  stop  now.  I'll 
let  the  defense  voir  dire  and  we'll  get  a  little  bit 
out  of  order  and  we'll  (INAUDIBLE)  that  issue  and  go 
forward  with  the  rest  of  your  direct . 

CAPTAIN  MORROW :  I'm  replacing  page  9  in 
the  prosecution  ID  110 . 

THE  COURT:      Can  the  witness  go  back  to  the 

chair? 

CAPTAIN  TOOMAN: 

MR.   MORROW:      The  witness  can  go  back  to 
the  chair,    Your  Honor. 

THE  COURT :      All  right . 

CAPTAIN  TOOMAN:     We  would  object  to 
Prosecution  Exhibit  110  as  hearsay. 

MAJOR  FEIN:      (INAUDIBLE)  retrieving 
Prosecution  Exhibit  81  for  the  witness . 

THE  COURT :      All  right . 

CAPTAIN  MORROW :      I ' ve  handed  the  court 
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reporter  110  for  ID. 

VOIR  DIRE  EXAMINATION 

Q  I  want  to  talk  to  you  a  little  bit  about 

archive  do  the  organize.      The  Prosecution  Exhibit  109 
for  identification,    you  didn't  actually  visit 
Wikileaks.org  in  2009,    did  you? 

A  No,    not  2009. 

Q  So  you  didn't  actually  see  what  their 

website  looked  like  in  2009? 

A  In  2009  I  did  not  actually  go  to  the 

website  and  see  it. 

Q  And  with  archive . org  what  you  see  is  what 

they  tell  you  was  there?     You  didn't  actually  see  what 
was  there  in  2009? 

A  If  I  go  to  archive.org  I  see  what  is 

presented  for  the  date  that  they  say  that  it  was  there . 

Q  Okay .     You  don ' t  have  any  knowledge  of  how 

archive.org  actually  compiles  their  data,   do  you? 

A  I  do  not.      I  have  various,    I  guess,   you  can 

say,   assumptions  of  how  it  works  based  on  my  knowledge 
in  the  field. 
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Q  But  you  don ' t  know  where  that  data  comes 

from? 

A  Which  data? 

Q  The  data  that ' s  on  archive . org . 

A  I  would  assume  that  it  comes  from  the  sites 

that  are  presented  that  they  archive . 

Q  So  you  don ' t  know  where  it  comes  from?  You 

don't  know  how  the  data  is  gathered? 

A  Technically,    no,    I  don't  know  how  that  data 

is  gathered. 

Q  You  don't  know  how  often  that  data  is 

gathered?     You  don ' t  know  the  frequency  of  that  data 
gathering? 

A  I  can  say  that  the  frequency  appears  to  be 

just  periodic.      It  doesn't  seem  to  have  a  set  schedule 
just  based  on  the  results  that  are  available. 

Q  And  you  don ' t  know  if  that ' s  all  of  the 

data  because  you  didn ' t  actually  go  to  the  website  in 
2009,  correct? 

A  The  website . 

Q  So  in  this  case  we ' re  talking  about  the 
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Wikileaks  most  wanted  list.     You  didn't  actually  go  to 
in  it  2009.      So  we're  looking  at  it  or  archive.org,  you 
don't  know  if  anything  is  missing,  correct? 

A  That  would  be  a  fair  statement . 

Q  Now,    you  mentioned  on  direct  that  when  you 

go  to  archive . org  there  are  some  todays  that  are 
missing . 

Do  you  know  why  that  is? 

A  I  don ' t  believe  that  I  said  there ' s  some 

days  that  were  missing. 

Q  I  think  you  said  that  the  calendar  would 

come  up  and  you  can  click  on  a  day  and  then  if  you  had 
the  ability  to  click  on  the  day  that  means  that 
archive.org  is  saying  that  you  have  a  website  for  that 
day,   but  I  would  massage  you  can't  click  on  every  day, 
can  you? 

A  You  cannot . 

Q  So  there  are  days  missing? 

A  There  are  days  when  the  archive.org  website 

does  not  appear  to  have  archived  that  website . 

Q  Do  you  have  any  knowledge  of  whether  or  not 
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a  website  could  embed  code  to  their  website  that  would 
prevent  archive.org  from  gathering  their  website? 

A  I  believe  there  is  a  file  that  web  host  or 

web  masters  can  put  on  their  site  called  robot. text, 
and  other  archiving  type  sites  are  supposed  to  respect 
that  file,   and  in  that  file  you  can  put  in  certain  key 
words  I  believe  that  be  tell  other  sites,   not  to 
archive  or  safe  copies  of  your  file  or  your  website . 

Q  Do  you  know  where  the  archive . org  servers 

are  located? 

A  I  have  no  direct  knowledge  of  that . 

Q  Do  you  know  when  archive . org  gears  their 

information? 

A  You  mean  like  time  of  day? 

Q  Time  of  day. 

A  Based  on  the  results  that  are  displayed  on 

their  website  for  various  given  sites  it  appears  to  be 
just  periodic.      It  doesn't  appear  to  be  any  particular 
time  of  day,   day  of  week,   or  any  other  pattern  that  I 
can  discern. 

Q  Are  you  aware  of  whether  or  not  are  there ' s 
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ever  been  any  hack  attempts  on  the  cache  servers 
employed  by  archive . org . 

A  I  do  not  have  any  direct  knowledge,   but  I 

would  be  surprised  if  there  were  not  any  hacks . 

Q  Do  you  have  any  knowledge  of  the  operating 

system  that  the  servers  are  running? 

A  I  do  not  have  knowledge  of  what  operating 

systems  they're  running. 

Q  Do  you  have  any  knowledge  as  to  whether  or 

not  there  are  backups  of  servers? 

A  I  do  not  have  any  direct  knowledge  of  that . 

Q  Were  you  actually  there  when  the  particular 

website  you  were  talking  about  today,   were  you  there 
when  it  was  cached  by  archive . org? 

A  Was  I  —  when  you  say  there? 

Q  Were  you  actually  there  when  whoever  from 

archive.org  gathered  what  they  say  was  this  website, 
were  you  actually  there  when  they  did  it? 

A  I  was  not  at  archive . org  wherever  their 

location,   when  that  was  archived. 

Q  You  talked  a  little  bit  about  a  robot. text 
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file  that  a  company  would  or  person  could  put  on  their 
website.     Do  you  have  any  knowledge  whether  Wikileaks 
had  one  of  those  on  their  website? 

A  I  do  not  have  any  knowledge  of  that . 

CAPTAIN  TOOMAN :     One  moment ,   Your  Honor . 
Please,    Your  Honor,   we  have  no  further  voir  dire 
questions  of  this  witness .     We  would  objection  to 
Prosecution  Exhibit  109  for  identification  because 
this,   where  it  says  has  no  personal  knowledge  of  how 
archive . org  operates . 

There  are  a  number  of  cases  that  are 
considered  the  admissibility  of  archive.org. 

THE  COURT :     You  plan  to  present  those  to  me 

when? 

CAPTAIN  TOOMAN:     Right  now,    Your  Honor. 
THE  COURT :      Thank  you . 

CAPTAIN  TOOMAN:      I  will  note  first  that 
none  of  those  cases  are  criminal  cases,   they  all  are 
civil  cases  dealing  with  either  trademark  or  pattern 
law.     One  of  them  is    (INAUDIBLE)    Telamuso .     Pardon  my 
pronunciation . 
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THE  COURT :     Why  don ' t  we  do  this :     You  can 
read  them  on  the  record,   but  if  you're  going  to  present 
me  cases  can  I  have  a  Xerox  copy  of  them? 

CAPTAIN  TOOMAN:     Yes,   ma'am.     One  of  them 
is  —  this  is  a  Polish  pronunciation.      (INAUDIBLE) . 

THE  COURT :     Yes . 

CAPTAIN  TOOMAN:      It's  2004  westlaw 
WL2367740.     And  in  that  case  the  Court  required  and 
affidavit  from  the  wayback  machine  from  the  proprietors 
of  the  wayback  machine  before  they  would  allow 
admissibility  and  also  St.   Luke's  Cataract  site,  2006 
westlaw  130242. 

In  that  case  the  Court  precluded  the 
admissibility  of  the  wayback  machine  absent 
testimony  from  someone  with  personal  knowledge.  In 
that  case  the  Court  wanted  actually  someone  from 
Wikileaks .      In  this  case  they  would  wanted  someone 
from  Wikileaks  to  come  and  talk  about  what  was 
actually  on  their  website  at  the  time. 

So  our  objection  to  presumption 
Exhibit  109  for  identification  would  be 
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authentication  as  well  as  double  hearsay,   and  we 
will,   of  course,   get  you  those  cases,   Your  Honor. 

THE  COURT:      Thank  you,    and  your  objection 
to  prosecution  110  is  hearsay? 

CAPTAIN  TOOMAN:     Yes,  ma'am. 

THE  COURT:  Okay. 

Government,   do  you  have  any  case 
authority  to  read? 

CAPTAIN  MORROW:      The  government  believes 
there  are  some  more  recent  cases,    Your  Honor,  with 
respect  to  the    (INAUDIBLE)    issue  wherein  have  the 
Delaware  state  issue.      I  don't  think  it's  a  Delaware 
state  issue. 

Agent  Mander ' s  testimony  was  very  clear 
that  is  a  battle  state  printout  that  was  a 
representation  of  the  archive.org  website  capturing 
another  website . 

THE  COURT:      So  are  you  offering  it  for  the 
truth  of  the  matter  asserted  or  not? 

CAPTAIN  MORROW:     We're  offering  both  of 
exiting  for    (INAUDIBLE) . 
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THE  COURT:     Okay.      The  hearsay  objection 
Exhibit  110,    is  overruled.      So  if  you  don't  have  any 
other  objections  to  Prosecution  Exhibit  110  I'll  admit 
that . 

CAPTAIN  TOOMAN:     We  would  also  based  on 
relevance.      There  is  no  evidence  that  PFC  Manning  ever 
saw  this  particular  website.      So    (INAUDIBLE)    and  that 
the  defense    (INAUDIBLE)   that  it's  not  relevant. 

THE  COURT:     What  else,   the  relevance? 

CAPTAIN  MORROW:     Your  Honor,    I  believe 
Agent  Mander  used  Prosecution  Exhibit  81  to  go  through 
and  provide  circumstantial  evidence  through  his 
testimony  of  user  of  those  computers  searching  for 
information  very  similar  to  information  of  the  similar 
site . 

THE  COURT:     What's  the  difference  between 
Prosecution  Exhibit  for  identification  109  and  110. 

MR.   MORROW:      There's  no  difference,  Your 
Honor.     We'll  leave  the  issue  alone  if  the 
Prosecution  Exhibit  110  is  admitted. 

THE  COURT:     Wait  a  minute,    let's  go  back 
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Prosecution  Exhibit .      I  may  have  to  go  to  just  remind 
the  witness    (INAUDIBLE) . 

Prosecution  Exhibit  110,   what  is  it  and 
what  did  you  do  to  get  it? 

THE  WITNESS:  Can  I  see  the  two  exhibits? 
To  answer  your  question,  ma'am,  I  believe  the  one 
exhibit  is  directly  from  the  Wikileaks  website  which 
was  recently  within  the  last  couple  of  weeks  and  the 
other  version  is  the  archive.org  version  of  the  same 
document  as  captured,  reportedly  captured  in  2009  by 
the  archive . org  website . 

THE  COURT:     Prosecution  Exhibit  110  was 
your  testimony  that  you  basically  Googled  the  Wikileaks 
website  and  there  that  document  was  and  you  printed  it . 

THE  WITNESS:      How  can  I  tell    (INAUDIBLE) . 

THE  COURT :      So  the  one  he  printed  himself 
is  Prosecution  Exhibit  110. 

CAPTAIN  MORROW:     Yes,  ma'am. 

THE  COURT :      Tell  me  how  you  got  the 
Prosecution  Exhibit  110. 

THE  WITNESS:      I  went  directly  to  the 
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Wikileaks.org  website  and  printed  out  the  document  that 
I  had  on  my  screen. 

MR .   HURLEY :      Just  with  respect  to  the 
Prosecution  Exhibit  110  for  identification,   those  are 
relevance  objections  based  on  this  was  —  I  believe  it 
date  on  that  it ' s  1  June . 

THE  COURT :      I'm  going  to  overrule  that . 
That's  the  date,    that  1  June  the  document  (INAUDIBLE) 
has  a  different  date.     That  is  in  the  document  that's 
on  the  website.      So  what  is  your  argument,    it's  going 
to  weight,   not  of  admissible. 

CAPTAIN  TOOMAN:     We  just  think  that  the 
date  2009  there's  no  approve  or  evidence  that  that  was 
actually  up  on  the  website  in  2009  nor  is  there 
evidence  that  PFC  Manning  actually  saw  in  it  2009. 

THE  COURT:      I  understand  all  of  that.  Now, 
with  respect  to  Prosecution  109,    I  will  take  that  under 
advisement.      I  will  consider  the  authority  offered  by 
both  sides  and  make  a  ruling  probably  tomorrow  morning. 
Do  you  have  cases  to  give  me  as  well? 

CAPTAIN  MORROW:     We  have  several  cases  that 
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we  —  yes ,   we  do . 

THE  COURT:      In  hard  copy? 

CAPTAIN  MORROW:     Yes,    Your  Honor. 

THE  COURT :     Depending  on  the  voluminous 
amount,   my  ruling  may  not  come  tomorrow  morning,   but  it 
will  be  coming. 

CAPTAIN  MORROW:      I'm  taking  Prosecution  110 
and  Prosecution  109. 

THE  COURT:      Can  I  see  Prosecution  Exhibit 

110? 

CAPTAIN  MORROW:     Yes,    Your  Honor. 

THE  COURT:     Prosecution  Exhibit  110  is 

admitted. 

BY  CAPTAIN  MORROW: 
Q  Agent  Mander,    are  you  familiar  with  the 

term,    social  media? 

A  Yes,    I  am. 

Q  What  is  social  media? 

A  General  term,    social  media,    refers  to 

either  websites  and/or  systems  that  encourage  members 
of  the  general  public  to  create  accounts  and  then 
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encourages  them  to  communicate  with  each  other . 

Q  What  are  some  examples  of  social  media 

website? 

A  Some  examples  might  include  website 

Facebook,   website  MySpace  as  well  as  Twitter  as  an 
example . 

Q  What  is  Twitter? 

A  Twitter  is  both  a  website  as  well  as  I 

guess  you  can  consider  it  software  that  runs  in  various 
platforms  that  allows  members  of  the  general  public  to 
submit  short  messages  which  other  members  of  the 
general  public  can  then  follow  or  subscribe  to. 

Q  During  the  course  of  an  investigation,  do 

you  recall  having  seen  a  Wikileaks  organization  Twitter 
feed? 

A  Yes,    the  Wikileaks  organization  has  a 

Twitter  account . 

Q  And  what  is  the  user  name  or  handle  of  that 

account  ? 

A  I  believe  it ' s   just  Wikileaks . 

Q  And  generally  why  do  people  use  Twitter? 
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What's  the  purpose  of  it? 

A  Personally  I  would  say  for  entertainment, 

however,   you  could  also  use  it  as  a  method  to 
disseminate  information  generally  widely  to  the  public. 

Q  And  how  is  Twitter  set  up?     You  know,  my 

understanding  of  Facebook  is,    you  know,    you  have 
friends  and  those  friends  can  see  your  Facebook 
website.     How  is  Twitter  set  up? 

A  Twitter  is  generally  set  up  in  that  any 

member  of  the  general  public  can  create  an  account  in 
which  they  can  then  post  short  messages . 

Other  members  of  the  general  public  can 
either  view  those  messages  by  serving  for  that  use 
other  their  website  or  they  can  subscribe  to  that 
user's  Twitter  feed  which  is  a  long  running  collection 
of  messages  directly  and  then  presumably  they  get  those 
messages  in  real  time,   or  near  real  time,   as  they  are 
submitted  to  the  system  or  the  site . 

Q  And  Wikileaks  Twitter  feed  you  referred  to 

earlier  the  Twitter  account  that  access  can  on  the 
Internet? 
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A  It  is  accessible  by  the  general  public  on 

the  Internet . 

Q  And  you  said  there ' s  a  feed,   what  do  you 

mean  by,   a  feed?     Just  that  explain  that  again,  please. 

A  I  would  describe  the  Twitter  feeds  as 

basically  a  collection  of  the  messages  that  have  been 
submitted  by  a  particular  user  account  and  they  appear 
generally  in  chronological  order  with  the  most  recent 
message  at  the  top  of  the  feed. 

Q  And  have  you  observed  the  Wikileaks  Twitter 

feed  recently? 

A  Somewhat  repeatedly,   yes . 

Q  And  how  active  is  that  feed? 

A  It  appears  to  be  very  active.     There  were 

messages  about  when  I  last  saw  it  about  this  trial 
occurring . 

THE  COURT:     When  was  that? 

THE  WITNESS:      I  believe  that  was  also  — 
CAPTAIN  TOOMAN:     Objection,    Your  Honor, 
relevance .     The  recent  feeds  of  Wikileaks  go  to  any 
element  of  the  charges  of  this  case  of  PFC  Manning. 
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THE  COURT:      Tell  me  the  last  time  you 

accessed  it. 

THE  WITNESS :  Sometime  after  the  beginning 
of  the  Manning  trial .  Maybe  the  3rd  or  4th  of  June  of 
this  year. 

THE  COURT:     What  is  relevant  to  that? 

CAPTAIN  MORROW:      I'm  just  laying  a 
foundation  of  the  witness '    knowledge  of  the  Twitter 
feed  that ' s  all  Your  Honor . 

THE  COURT:      That's  all.      I'll  consider  it. 
Okay .     Go  ahead . 

Before  you  continue  your  testimony  was 
that  software  that  runs  on  various  platforms,  what 
is  a  platform? 

THE  WITNESS:     A  platform  could  be 
considered  a  computer,   a  smart  phone,   tablet,  different 
types  of  computer  hardware,    Your  Honor. 

THE  COURT :      Thank  you . 

BY  CAPTAIN  MORROW: 
Q  Now,   have  you  reviewed  —  when  you  recently 

reviewed  the  Twitter  feed,    the  Wikileaks  Twitter  feed, 
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could  you  tell  whether  there  had  been  tweets  or  were 
the  tweets  from  you  know  several  years  ago  still 
available  to  you? 

A  It  appears  that  all  of  the  publicly 

published  messages  from  any  given  account  are  remain  on 
the  site  indefinitely. 

Q  And  we  talked  about  the  Internet  archive 

previously.     Now,   do  you  have  to  use  the  Wikileaks  or 
have  you  had  to  use  the  Internet  access  tweets 
(INAUDIBLE)    from  the  past  or  are  those  tweets  still 
available? 

A  When  I  attempted  to  look  at  Twitter 

messages  on  Internet  archive  I  received  a  message 
saying  those  were  unavailable,   and  I  generally  assumed 
because  of  the  volume  of  messages  that  are  in  archive 
does  not  archive  or  catalog  those . 

Q  I'm  showing  you  Prosecution  Exhibit  32  for 

identification . 

CAPTAIN  MORROW:      I'm  showing  it  to 
defendant ' s  counsel . 

BY  CAPTAIN  MORROW: 
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Q  Agent  Mander,    I'd  like  you  to  go  to  the 

second  of  page  on  this  exhibit .      If  you  would,  would 
you  please  —  do  you  recognize  that  document? 

A  Yes,    I  do. 

Q  And  what  is  it? 

A  This  is  a  printout  of  the  Google 1 s  cached 

version  of  a  Twitter  message  sent  on  the  Wikileaks 
Twitter  account . 

Q  And,    again,   what's  the  Google?     When  you 

say  it's  the  Google  cached   (INAUDIBLE),   what  do  you 
mean  by  that? 

A  It  is  the  version  that  Google  saves  as  a 

search  result  that  you  can  use  to  view  a  particular 
website  if  for  some  reason  that  website  is  maybe 
unavailable  directly. 

Q  Now,   do  you  have  to  use  the  Google 

passwords  do  access  the  Wikileaks  feed? 

A  You  do  not . 

Q  Let ' s  talk  about  that  specific  printout . 

Is  the  tweet  dated? 

A  The  message  is  dated.      It's  dated  8/  or 
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possibly  6  January  of  2010. 

CAPTAIN  MORROW:     Your  permission  to  publish 
to  the  Court . 

THE  COURT:      Go  ahead. 
BY  CAPTAIN  MORROW: 

Q  That's  kind  of  hard  to  see,   Agent  Mander, 

but  I  want  to  talk  about  some  of  the  sort  of  graphics 
behind  the  message.     Have  you  seen  —  first,    can  you 
describe  sort  of  that  graphic? 

A  The  background  graphic  appears  to  be 

repeated  four  times  horizontally.      It  appears  to  be  I 
guess  describe  as  two  globes  that  are  in  an  hour  glass 
and  they  appear  to  be  top  upper  most  one  appears  to  be 
dripping  to  the  lower  one . 

Q  And  have  you  seen  that  graphic  like  that 

before? 

A  That  appears  to  be  the  logo  or  graphic  that 

is  typically  permanently  displayed  on  the  Wikileaks 
website . 

Q  Now,   Agent  Mander,    you  said  this  is  a 

representation  of  something  you  printed,    or  explain 
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exactly  what  this  is  again,  please? 

A  Sometimes  we  take  what  we  call  a  screen 

capture  which  is  a  —  we  can  use  various  types  of 
software  to  actually  take  what ' s  called  a  picture  of 
the  computer  screen  monitor,   whatever  we're  looking  at 
and  then  save  it  as  a  graphics  file . 

So  you ' 11  actually  see  in  the  bottom 
right— hand  corner  some  of  the  information  from  my 
computer  as  well  as  one  of  the  windows  I  had  opened 
down  in  the  bottom.      That's  kind  of  hard  to  see  from 
this,   but  it's  there. 

Q  And  did  you  —  what  do  you  after  you 

observed  this  on  the  web  page?     What  did  you  do? 

A  I  believe  I  took  a  screen  capture  of  the  — 

when  I  was  looking  at  and  this  item  was  printed  out 
and  —  can  you  move  it  up  so  I  can  see  the  bottom? 

Q  Sure . 

A  On  the  very  bottom  is  the  time  and  date  of 

when  this  item  was  printed,    and  those  are  my  initials 
that  I  actually  put  on  the  printed  page . 

CAPTAIN  MORROW:     Your  Honor,  the 
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prosecution  offers  Prosecution  Exhibit  32  for 
identification.      This  is  Prosecution  Exhibit  32. 

CAPTAIN  TOOMAN:     We  will  object,  Your 
Honor.     Again,   personal  knowledge.     We  use  a  web  cache. 
Didn't  actually  view  the  tweet  on  the  date  reported  to 
be  and  also  relevance  because,   again,   not  I  guess 
viewed  on  1  June  so    (INAUDIBLE)    and  I  guess  personal 
knowledge  of  how  Google  — 

THE  COURT :     Do  you  want  to  voir  dire  the 
witness  with  respect  to  his  personal  knowledge  on 
Google  cache? 

CAPTAIN  TOOMAN:      I  would  like  to. 

CAPTAIN  MORROW:     May  I  ask  you  a  few 
questions,    Your  Honor? 

THE  COURT :     Yes . 

BY  CAPTAIN  MORROW: 
Q  With  regard  to  this  tweet,    can  you  read  the 

tweet? 

A  The  message  that  is  tweeted  is,  have 

encrypted  videos  of  U.S.   bomb  strikes  on  civilians 
http://bit.ly/wlafghan2  need  super  computer  time. 
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Http : / / 1 j  s  f . org . 

Q  Again,    is  that  tweet  dated? 

A  It  appears  to  be  either  6  or  8  January  of 

2010  . 

Q  And  have  you  seen  that  tweet  before  in 

another  context  other  than  the  Google's  cache? 

A  This  tweet  is  also  on  the  Wikileaks  Twitter 

account . 

Q  So  how  would  you  find  that  tweet  on  the 

Wikileaks  Twitter  account? 

A  One  of  two  ways .     You  could  either  do  a 

search  for  it  using  something  like  Google  and  then  go 
directly  to  the  Twitter  page  that  has  that  message  or 
you  could  go  to  Twitter  look  for  the  Wikileaks  account 
and  then  presumably  scroll  did  you  look  all  of  their 
messages  newly  found  this  particular  one. 

Q  Have  you  done  that  as  part  of  this  case? 

A  I  did  the  first  mentioned  way .      There  was  I 

believe  like  thousands  of  Twitter  messages .     So  I  did 
not  read  every  single  one. 

Q  But  you  read  this  one? 
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Yes,    I  saw  this  one. 
And  you  printed  this  one? 
I  did. 

Do  you  recall  when  that  was? 

That  was  sometime  ago .     That  was  maybe  last 


A 

Q 
A 

Q 
A 

year . 

CAPTAIN  MORROW: 

the  witness. 

THE  COURT:  Are 
CAPTAIN  MORROW: 
respect  to  that . 

THE  COURT:  You 
CAPTAIN  MORROW: 

coming . 

THE  COURT:  Are 

objection? 

CAPTAIN  TOOMAN: 
THE  COURT:  Why 
you ' 11  get  your  chance . 


I'm  taking  exhibit  from 

you  finished? 
Yes,    Your  Honor,  with 

have  more  coming? 
I  have  more  one  tweet 

you  anticipating  the  same 

Yes  . 

don't  we  go  through  it  and 


BY  CAPTAIN  MORROW: 
Q  I'm  retrieving  Prosecution  Exhibit  31  for 
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identification  from  the  court  reporter.      I'm  handing 
the  witness  what's  been  marked  as  Prosecution  Exhibit 
31  for  identification. 

Agent  Mander,    do  you  recognize  that 

document  ? 

A  Yes ,    I  do . 

Q  And  what  is  it,    and,    again,    concentrate  on 

the  first  page? 

A  This  document  is  a  screen  capture  showing 

another  tweet  from  a  Wikileaks  website  as  cached  by 
Google . 

Q  And  what  date  is  that  tweet? 

A  The  date  of  the  tweet  is  7  May  2010. 

Q  And  what's  the  content  of  the  message? 

A  The  message  reads,   we  would  like  a  list  of 

as  many  dot  e-mail  addresses  as  possible.  Please 
contact  editor  at  sign  Wikileaks.org  or  submit. 

Q  And  you  used  this  tweet  using  Google  cache 

on  your  computer? 

A  I  did. 

Q  What  did  you  do  after  you  observed  the 
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tweet? 

A  I  took  a  screen  capture  and  then  printed 

out  that  screen  capture,   and  initially  the  printed  page 
was  printed  out . 

Q  And  did  you  do  that  at  the  same  time  as  the 

other  tweet  we  just  talked  about? 

A  Roughly  at  the  same  time . 

Q  Approximately? 

A  Yes . 

Q  And  with  respect  to  Prosecution  Exhibit  31 

for  ID,   you  talked  —  we  previously  talked  about  the 
background .      I'm  handing  it  back  to  you .  The 
background  text,   the  graphics,   and,   again,   where  have 
you  seen  these  that  background  text  of  graphics? 

A  The  background  graphics  appear  to  be 

identical  to  the  other  tweet,   and  I've  seen  the  same 
similar  graphic  on  the  Wikileaks.org  website. 

Q  Have  you  seen  that  message  before  in  the 

Wikileaks  Twitter  feed,   not  in  a  Google  cache  form? 

A  Yes.      It's  still  available  on  the  actual 

Twitter  account  of  their  feed  from  the  Wikileaks 
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Twitter  account . 

Q  When  did  you  see  that  tweet  in  the  regular 

Wikileaks? 

A  That  was  sometime  ago,    and  I  don't  remember 

the  exact  date . 

Q  Was  it  approximately  the  same  date  as  you 

the  saw  the  other  tweet? 

A  Yes . 

Q  And,   again,   what  did  you  do  at  that  time 

with  that  tweet? 

A  Essentially  something  similar,    took  a 

screen  capture  or  printed  the  tweet  onto  paper  and  then 
initialed  that  piece  of  paper. 

CAPTAIN  MORROW:      I'm  retrieving  Prosecution 
Exhibit  31  for  identification  and  handing  it  to  the 
court  reporter.     Your  Honor,   we  would  move  to  admit 
this  exhibit  for  identification  as  well. 

THE  COURT:     All  right.      I  assume  the  same 

objection? 

CAPTAIN  TOOMAN:     Yes,  ma'am. 

THE  COURT:     Okay.     What  is  your  objection 
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to  Prosecution  Exhibits  31  and  32? 

CAPTAIN  TOOMAN:     Your  Honor,   we  would 
object  to  hearsay.     We  would  also  object  that  the 
witness  has  no  personal  knowledge  and  can't 
authenticate  them.     No  personal  knowledge  of  how  Google 
creates  their  cache . 

THE  COURT:      If  I'm  understanding  the 
government's  position,    they're  not  offering  it  to  admit 
(INAUDIBLE)   that  basis,   they're  offering  to  admit  it  on 
the  prior  or  both,   what  are  you  doing? 

CAPTAIN  MORROW:     Your  Honor,   we  actually 
have  the  prior  version  printed  and  that  was  produced  in 
discovery  as  well .     The  reason  we  didn ' t  — 

THE  COURT:     On  what  basis  are  you  moving  to 
add  in  these? 

CAPTAIN  MORROW:     Excuse  me? 

THE  COURT:     On  which  basis  are  you  going  to 
admit  these  two  exhibits . 

CAPTAIN  MORROW:     We  are  not  offering  either 
exhibit  for  the  truth.     We're  offering  it  for 
(INAUDIBLE) . 
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THE  COURT:     Are  you  offering  the  Google 
will  cache  or  are  you  offering  the  prior  look? 

CAPTAIN  MORROW:     We're  offering  the  prior 
look  and  we'll  actually  add  that  as  an  exhibit  Alpha  to 
these  exhibits.     The  reason  that  we  didn't  have  them  on 
this  dates  is  when  we  printed  it ' s  very  hard  to  see  the 
date  of  the  tweet .     So  we  used  this  color  version  to 
mark  as  an  exhibit  so  that  the  date  could  be  readable . 

We  can  —  we  will  certainly  —  can 
attach  or  mark  the  other  version  that  Agent  Mander 
as  printed  and  initialed  as  well. 

THE  COURT :     All  right .      Go  ahead  captain . 
CROSS  EXAMINATION 
Q  Just  a  few  questions  about  your  knowledge 

of  Google  cache  and  Twitter.     Do  you  personally  have  a 
Twitter  account? 

A  I  do  not . 

Q  Do  you  have  any  knowledge  of  how  Twitter 

archives  their  messages? 

A  When  you  say  —  can  you  be  more  specific? 

Q  Do  you  know  how  they  do  it? 
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A  I  don ' t  know . 

Q  Do  you  know  the  process  they  go  through  in 

order  to  save  tweets? 
A  No. 

Q  Do  you  know  if  a  tweet  can  be  deleted? 

A  I  do  not  know  for  certain,  no. 

CAPTAIN  MORROW:      A    (INAUDIBLE)    printout  of 
a  web  page,    so  his  knowledge  of  Twitter  is  not 
necessarily  or  relevant . 

THE  COURT :      I'm  going  to  overrule  that . 
Go  ahead . 

BY  CAPTAIN  TOOMAN: 

Q  Agent  Mander,    I  want  to  talk  to  you  about 

Google  cache .     Do  you  know  how  Google  goes  about 
creating  their  cache? 

A  Specifically  the  technical  aspects,  no. 

Q  Do  you  know  where  their  servers  are 

located? 

A  I  believe  they  have  servers  located  in  many 

places . 

Q  Do  you  know  where  the  servers  are  located 


Provided  by  Freedom  of  the  Press  Foundation 


1 

2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 


UNOFFICIAL  DRAFT  -  6/10/13  Afternoon  Session 


86 


that  service  the  cache? 
A  I  do  not . 

Q  Do  you  know  how  often  Google  goes  out  and 

creates  their  cache,   how  often  they  go  out  and  grab 
data? 

A  I  do  note . 

Q  And  do  you  know  if  they  use  a  program  or  a 

proprietor  algorithm  in  order  to  grab  that  information? 
A  I  would  assume,   yes,   they  do. 

Q  You  assume  that,   but  do  you  actually  know? 

A  I  do  not . 

Q  Do  you  know  the  frequency  with  which  Google 

goes  out  and  grabs  information? 
A  I  do  not . 

Q  Do  you  know  if  there's  any  way  that  a  web 

page  would  prevent  Google  from  grabbing  it? 

A  I  believe  the  robot. text  file  that  we 

talked  about  before  is  a  method. 

Q  Adds  you  answered  before  when  we  were 

talking  about  tack  archive.org.     Do  you  also  not  know 
whether  Wikileaks.org  employees    (INAUDIBLE)    one  over 
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those  for  their  text  files? 

A  I  do  not  know  if  they  employ  one  of  those 

text  files . 

Q  There  are  a  couple  of  dates  on  these  tweets 

that  were  hard  to  read.     Did  you  ever  actually  look  at 
Twitter  on  those  dates? 

So  6  January  or  8  January,    2010,    did  you 
look  at  the  tweet  that  day? 

A  I  did  not . 

Q  Do  you  know  if  the  Google  cache  servers 

have  ever  been  hacked? 

A  I  do  not  know  that . 

Q  Do  you  know  if  anyone  has  ever  tried  to  do 

that? 

A  I  do  not  know  that . 

Q  Do  you  know  the  operating  system  that 

Google  cache  runs? 

A  I  do  not  know  that . 

Q  Do  you  know  if  they  have  backups  of  their 

servers? 

A  I  have  no  actual  knowledge  of  that ,   no . 
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CAPTAIN  TOOMAN:     Your  Honor,   we  would  renew 
our  objections  authentication  for  Prosecution  Exhibit 
31  for  identification  and  32  for  identification  as  well 
as  is  hearsay,   Your  Honor,   and  we'll  address. 

THE  COURT :      I  believe  the  government  told 
me  that  they're  offering  it  for  nonhearsay  purposes;  is 
t  hat  co  r r e  ct  ? 

CAPTAIN  MORROW:     We  are,    Your  Honor. 

THE  COURT:     What  is  that? 

CAPTAIN  MORROW:  With  respect  for  the 
tweets  we're  offering  for  (INAUDIBLE)  that  is  the 
e-mail . 

THE  COURT:      I'm  sorry,    I  interrupted  you. 
Authentication  and  hearsay  with  respect  to  Prosecution 
Exhibit  31  and  32,  right? 

CAPTAIN  TOOMAN:  Yes. 

THE  COURT:     About  prosecution  109  you  have, 
your  objection  to  that  one  was? 

CAPTAIN  TOOMAN:      109  would  be  the  same, 
Your  Honor,    as  well  as  relevance. 

THE  COURT:     Do  you  have  any  redirect? 
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CAPTAIN  MORROW:     A  couple  of  questions. 
REDIRECT  EXAMINATION 
Q  Do  you  know  how  to  use  the  Internet? 

A  Yes . 

Q  Do  you  know  how  to  navigate  a  web  page  on 

the  Internet? 

A  Yes . 

Q  And  in  this  case  have  you  navigated  to  web 

pages  on  the  Internet? 
A  I  have . 

Q  And  give  me  a  couple  of  example  of  web 

pages  you've  navigated  to  on  the  Internet  as  part  of 
the  investigation? 

A  The  Wikileaks  website,   the  Facebook  profile 

of  PFC  Manning,    the  Twitter  messages  that  we've 
discussed  as  well  as  the  archived  versions  of  various 
other  sites.     More  examples? 

Q  No,    I  think  that's  enough.      Thank  you. 

THE  COURT:     All  right,   temporarily  excuse 
this  witness  or  permanent  excuse. 

CAPTAIN  TOOMAN:      I  was  personally  under  the 


Provided  by  Freedom  of  the  Press  Foundation 


1 

2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 


UNOFFICIAL  DRAFT  -  6/10/13  Afternoon  Session 


90 


impression  that  I   just  voir  dired  the  witness . 

THE  COURT:     You  have  further  cross 

examination? 

CAPTAIN  TOOMAN:     Yes,  ma'am. 

THE  COURT:      I  didn't  realize  that.  You're 
still  under  direct  examination. 

CAPTAIN  MORROW:      I'm  looking  for  my  direct, 
so  give  me  a  second. 

THE  COURT:     Would  the  this  been  a  good  time 
to  recess  the  Court  for  about  ten  minutes . 

CAPTAIN  MORROW:     Absolutely,   Your  Honor. 

CAPTAIN  TOOMAN:     No  objection,    Your  Honor. 

THE  COURT:      The  Court  is  in  recess  until 

1715  . 

(Hearing  recessed  at  1717  p.m.) 
(Hearing  resumed  at  1725  p.m.) 
THE  COURT:     You're  still  under  oath. 

(INAUDIBLE) 

CAPTAIN  MORROW:     At  this  time  the 
prosecution  has  no  further  questions . 

THE  COURT :      Captain  Tooman . 
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CAPTAIN  TOOMAN:     Before  I  begin  my  cross 
examination  I'd  like  to  ask  two  voir  dire  questions  of 
the  witness  with  respect  to  the  tweets  and  the 
government  assertion  that  they  would  like  to  admit  it 
for  the  effect  of  the  listener. 

THE  COURT:  Okay. 

VOIR  DIRE  EXAMINATION 

Q  Agent  Mander,    did  you  do  find  any  evidence 

that  PFC  Manning  —  over  the  course  of  your 
investigation,    did  you  find  any  evidence  that  PFC 
Manning  actually  reviewed  those  tweets? 

A  I  personal  did  not . 

Q  Did  you  look  for  that  evidence? 

A  I  did  not  personally  look  for  that 

evidence . 

CAPTAIN  TOOMAN:      I  guess  for  our  objection, 
Your  Honor,   were  that  relevance  if  there's  no  the 
evidence  that  PFC  Manning  actually  saw  at  tweets  there 
could  be  no  effect  on  him. 

THE  COURT:      So  you  have  three  objections  to 
all  three  of  them? 
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CAPTAIN  TOOMAN:     Yes,  ma'am. 

THE  COURT:      (INAUDIBLE),    authentication,  or 

hearsay . 

CAPTAIN  TOOMAN:     Yes,  ma'am. 
THE  COURT:      Got  it. 
BY  CAPTAIN  TOOMAN: 
Q  Agent  Mander,    I'd  like  to  talk  just  a 

little  bit  about  your  investigation  generally.     Sort  of 
the  tenant  of  your  profession  that  if  you  do  something 
you  document  it . 

A  Yes . 

Q  And  you  had  —  if  you  find  a  lead  or  a  clue 

you're  going  to  document  that  as  well? 
A  Yes. 

Q  If  you  talk  to  a  witness  you'll  document 

that? 

A  Yes . 

Q  If  you  researched  something  and  uncover 

something  relevant  to  the  investigation  would  you 
document  it? 

A  Yes . 
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Q  Now,    over  the  course  of  your  investigation 

in  this  case  you  did  a  lot  of  different  types  of  things 
you  talked  about  on  direct  examination.     You  did 
witness  interviews? 

A  Yes . 

Q  I  think  you  reviewed  e-mails? 

A  Yes . 

Q  You've  reviewed  chats? 

A  Yes . 

Q  You  also  reviewed  financial  transactions? 

A  Could  you  be  more  specific? 

Q  Did  you  look  at  bank  records  as  well? 

A  I  don't  remember  specifically  looking  at  a 

banking  records  personally . 

Q  Okay .      So  when  you ' re  looking  at  those 

various  things,    if  you  have  something  important  you  put 
it  up,    you  write  it  down  in  an  AIR  and  you  notify 
everyone  who  is  involved  that  we  have  this  lead  and 
let's  go  after  this,  correct? 

A  Generally  speaking,  yes. 

Q  Now,    thinking  about  all  the  things  that  you 
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looked  at  in  this  case  you  looked  at  chats  and  e-mails 
and  witness  interviews .     When  you  were  investigating 
this  case  you  knew  what  PFC  Manning  was  accused  of, 
correct? 

A  Generally,  yes. 

Q  You  knew  generally  what  the  charges  were 

against  him? 

A  Depending  on  what  point  of  the 

investigation  initially,    no,   there  weren't  any  charges 
for  extended  period  of  time .      I  believe  the  charges  at 
some  point  were  modified,   and  I  don't  know  the  legal 
term  for  that  but . 

Q  Okay .     But  when  they  were  charges  you  knew 

what  they  were  and  when  the  charges  changed  you  knew 
what  they  were  at  that  point  as  well? 

A  Generally  speaking,  yes. 

Q  Over  the  course  of  your  investigation  you 

didn ' t  find  any  evidence  that  PFC  Manning  had 
antiAmerican  beliefs,  correct? 

A  Well,   as  we  discussed  when  we  had  an 

interview,    yourself  and  myself,   there  was  one  thing 
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that  I  mentioned  to  you  that  was  brought  up  by  the 
witness  of  this  case. 

Q  But  not  a  witness  you  personally 

interviewed? 

A  Correct . 

Q  So  in  the  course  of  your  investigation,  and 

I  just  want  to  talk  about  the  things  you  did  and  the 
things  you  looked  at  and  the  people  you  talked  to . 

A  Okay . 

Q  You  didn't  find  any  evidence  or  any 

indication  that  PFC  Manning  was  antiAmerican  that  he 
hated  America? 

A  No. 

Q  You  also  didn't  find  any  evidence  that  PFC 

Manning  was  trying  to  help  the  enemy,   that  he  wanted  to 
affirmatively  give  something  to  the  enemy? 

A  Is  that  a  question? 

Q  Yes .     You  never  found  anything  in  witness 

interviews,    chats,    e-mails  where  PFC  Manning  said 
something  like  I  want  to  help  the  enemy? 

A  I  did  not  find  anything  where  he  said  he 
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wanted  to  help  the  enemy . 

Q  Okay.     You  also  reviewed  a  lot  of 

communications  with  individuals  and  you  would  have 
noted  any  contact  with  the  more  than  nationals  you 
would  have  noted,  correct? 

A  Correct . 

Q  And  you  found  out  some  because  PFC  Manning 

lived  in  whales  nor  a  while  so  you  had  foreign  contact 
right? 

A  Yes . 

Q  For  a  while  that  was  kind  of  a  focus  of 

your  investigation  you  thought  that  maybe  PFC  Manning 
was  working  for  some  sort  of  foreign  intelligence 
service,  correct? 

A  That  wasn't  really  the  CID  focus.      That  was 

probably  more  of  the  Army  military  intelligence  focus . 

Q  But  when  you  were  conducting  your 

interviews  you  certainly  explored  that  idea,  didn't 
you? 

A  Yes,    that  was  a  question  I  would  have 

asked. 
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Q  And  you  didn't  find  any  evidence  that  he 

was  associated  with  any  sort  of  foreign  intelligence 
service,  correct? 

A  I  did  not  personally  find  that,  no. 

Q  You  also  didn't  find  any  evidence  that  PFC 

Manning  was  paid  in  any  way  or  had  any  releases  he  may 
have  done? 

A  I  did  not  personally  find  out  find  any 

information  that  he  was  paid. 

Q  I'm  going  to  retrieve  what's  been  marked  as 

Defense  Exhibit  fox  trot  for  identification. 

I'm  handing  you  defendant's  Exhibit  fox 
trot  for  identification  to  the  witness . 

Agent  Mander,    do  you  recognize  that 

document  ? 

A  Yes,    I  do. 

Q  What  is  it? 

A  This  appears  to  be  a  printout  of  a  web  page 

on  Wikileaks.org  website. 

Q  How  do  you  know  that? 

A  I  printed  this  out  and  my  initials  appear 
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on  the  lower  right— hand  corner  of  each  page . 
Q  How  did  you  find  that  document? 

A  This  document  is  a  variation  of  the  other 

documents  that  the  prosecution  mentioned  earlier. 

THE  COURT:     Which  other  document? 
THE  WITNESS:      I  believe  it's  Exhibit  110, 
if  I'm  not  mistaken. 

CAPTAIN  TOOMAN:     Prosecution  110,  Your 

Honor . 

THE  WITNESS:     And  this  document,    the  other 
document  as  well  as  some  other  information  relating  to 
this  most  wanted  leaks  of  2009  document  were  revealed 
via  search  on  the  Internet  specifically  using  Google. 
BY  CAPTAIN  TOOMAN: 
Q  And  you  did  that  search? 

A  I  did  that  search. 

Q  And  you  printed  that  document? 

A  I  printed  that  document . 

Q  I'm  going  to  retrieve  document  fox  trot  for 

identification.      I  request  permission  to  publish 
(INAUDIBLE)  available? 
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THE  COURT:  Proceed. 
BY  CAPTAIN  TOOMAN: 

Q  (INAUDIBLE)   now,   you  testified  about  a 

similar  document  on  direct .     What  is  different  about 
this  document,   Agent  Mander? 

A  Well,   the  most  notable  difference  from 

Exhibit  110  on  the  top  there  where  it  says  draft  colon 
the  most  wanted  leaks  of  2009.     On  the  other  document 
Exhibit  110  document  at  the  end  of  2009  there's  the 
word  hyphen  and  then  the  word  sort ,    S— O— R— T . 

Q  Would  you  agree  with  me  that  this  document 

also  includes  a  little  bit  more  information  at  the  top 
of  the  document? 

A  The  documents  are  similar,   but  different . 

Q  Would  you  agree  that  defense  Exhibit  fox 

trot  has  more  introductory  information  than  prosecution 
110? 

A  Yes  in  the  list  of  countries  on  the  right 

versus  the  left  and  there ' s  obviously  some  other 
differences  as  well . 

Q  The  biggest  difference  would  be,   you  would 
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agree  with  me,    I'm  pointing  you  to  the  very  first 
paragraph  here  at  the  pop .     That  paragraph  does  not 
appear  on  the  version  introduced  by  the  government, 
correct? 

A  I  would  have  to  see  both  documents  again. 

Q  Okay.      I'll  retrieve  prosecution  110. 

CAPTAIN  TOOMAN :      I'm  going  to  hand 
Prosecution  110  to  the  witness. 

THE  WITNESS:      I'm  sorry,    could  you  repeat 
your  question? 

BY  CAPTAIN  TOOMAN: 
Q  Would  you  agree  that  the  introductory 

portion  of  the  defense  Exhibit  fox  trot  for 
identification  is  not  included  on  Prosecution  Exhibit 
110? 

Just  there  on  the  first  page  —  actually, 
look  through  the  entire  document  and  just  make  sure  for 
me  that  it  doesn ' t  appear  anywhere  in  there . 
A  (Witness  reviewing  document . ) 

The  paragraph  on  the  displayed  version  does 
not  appear  to  be  in  this  document . 


Provided  by  Freedom  of  the  Press  Foundation 


1 

2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 


UNOFFICIAL  DRAFT  -  6/10/13  Afternoon  Session 


101 

CAPTAIN  TOOMAN:      I'm  going  to  retrieve 
Prosecution  110  for  the  witness. 

THE  COURT:     May  I  see  both  of  those 
exhibits  quickly.     Have  you  introduced  yours  yet? 
CAPTAIN  TOOMAN :     Not  yet . 
THE  COURT:      Go  ahead. 
BY  CAPTAIN  TOOMAN: 
Q  You  would  agree  with  me  with  this  version 

defense,   Exhibit  fox  trot,    includes  more  information 
about  how  this  list  was  populated,   correct?     If  you 
need  to  take  a  moment  to  read  that,   please,  do. 

A  This  version  is  an  editable  version  so  that 

general  members  of  the  public  can  edit  this  version. 

Q  And  what  this  version  says  at  the  top  is 

that  the  most  wanted  leaks,   the  concealed  documents 
(INAUDIBLE)   the  concealed  documents  are  recordings  most 
sought  after  by  countries  journalists,  activists, 
historians,    lawyers,   police,    or  human  rights 
investigators.     Do  you  agree  with  that? 

A  That's  a  paraphrase  of  what  it  says,  sir. 

Q  A  paraphrase  or  literally  what  it  says? 
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A  Paraphrase  of  what  it  says . 

Q  Okay.     We'll  try  it  again.      2009 's  most 

wanted  leaks-the  concealed  documents  are  recordings 
most  sought  after  by  a  countries  journalists, 
activists,    historians,    lawyers,   police,    or  human  rights 
investigators? 

A  That ' s  literally  what  it  says . 

Q  And  that  paragraph  didn ' t  appear  on  the 

prosecution  exhibit,  correct? 

A  It  did  not . 

Q  And  you  would  agree  with  me  that  this 

demonstrates  kind  of  the  purpose  of  Wikileaks .  Would 
you  agree  with  that? 

A  Can  you  be  more  specific? 

Q  Sure .     You  would  agree  what  this  statement 

at  the  beginning  sits  out  why  Wikileaks  wants  these 
documents  they  want  it  because  they  have  been? 

CAPTAIN  MORROW:     Objection,    Your  Honor, 

speculation . 

THE  COURT:     Ask  some  foundational  questions 
about  whether  he  knows  that  why  Wikileaks  wants 
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documents . 

BY  CAPTAIN  TOOMAN: 
Q  Agent  Mander,    do  you  know  why  Wikileaks 

want  s  do  cument s  ? 

A  I  don ' t  have  the  actual  knowledge  of  were 

they  want  specific  documents.      I  presume  that. 

THE  COURT :     You  presume  based  on? 

THE  WITNESS :     My  experience  knowledge  of 

this  case. 

BY  CAPTAIN  TOOMAN: 

Q  Would  this  document  also  aid  your 

presumption? 

A  Can  you  clarify  your  question. 

Q  When  reading  this  introductory  paragraph 

does  that  I  guess  informed  your  understanding  of  why 
Wikileaks  wants  documents? 

A  It  just  seems  to  say  that  in  2009  those  are 

the  most  wanted  documents  by  those  groups  of  people . 
It  doesn't  necessarily  say  why  Wikileaks  wants  them. 

Q  Let ' s  move  down  to  this  paragraph .      Can  you 

see  where  I'm  pointing  here?     I'm  pointing  to  the 
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paragraph  that  starts  with  document  are  other  materials 
added   (INAUDIBLE)   must  and  you  would  agree  with  me  that 
it  says  can  likely  to  have  political,  diplomatic, 
(INAUDIBLE)    and  historic  impact  on  release? 
A  That  is  what  it  says . 

Q  Okay.     Now,   having  read  that  and  seen  that, 

does  that  inform  your  understanding  of  what  Wikileaks, 
the  purpose  of  Wikileaks  and  what  they  want? 

A  My  understanding  of  this  document  is  that 

they  were  trying  to  create  a  list  of  documents  that 
would  be  the  categories  listed  below  where  I  just 
pointed  out,    things  that  are  political,    diplomatic,  or 
other  things  that  would  be  impactful. 

CAPTAIN  TOOMAN:     Your  Honor,    at  this  time 
the  defense  offers  Exhibit  fox  trot  for  identification 
of  defense  Exhibit  fox  trot . 

THE  COURT:     Any  objection? 

CAPTAIN  MORROW :     One  moment ,   Your  Honor . 

Your  Honor,   the  objection  would  be 
authentication.     We're  not  sure  what  this  document 
purports  to  be  based  on  at  least  the  witness' 
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testimony . 

THE  COURT:     All  right.      Tell  me  one  more 
time,   Prosecution  Exhibit  110,   which  I  do  admit.  I'm 
not  asking  the  government,    just  the  witness  a  question 
here.     Prosecution  Exhibit  110  I  would  like  to  see  that 
exhibit  now,    if  I  could,    and  defense  Exhibit  fox  trot 
again . 

Special  Agent  Mander  Prosecution  Exhibit 
110  you've  already  testified  that  it's  different 
from  defense  Exhibit  fox  trot .     Both  of  those 
exhibits,   defense  fox  trot  for  identification  have 
your  initials  and  printed  Saturday,    June  1st  on  the 
bottom  right;    is  that  correct? 

THE  WITNESS:      That  is  correct. 

THE  COURT :      It  looks  like  the  one  defense 
Exhibit  110  is  printed  at  1539:36  and  the  difference 
Exhibit  fox  trot  for  identification  was  1637:47.  So 
defense  Exhibit  fox  trot  came  after  the  government 
exhibit? 

THE  WITNESS:      If  that's  the  way  the  times 
( INAUDIBLE )   yes ,   ma ' am . 
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THE  COURT:      I   just  want  to  ask  the  witness 
a  couple  of  questions.      I'm  going  to  hand  you  both  of 
the  exhibits  and  can  you  just  walk  me  through  how  you 
got  them  both  and  what  you  did? 

THE  WITNESS :      There  was  some  other 
documents  that  accompanied  these.     Are  those  available? 

CAPTAIN  MORROW:     Your  Honor,   those  have 
been  produced  in  discovery,   but  they're  not  part  of  the 
exhibit . 

THE  COURT:     Okay.      Can  you  tell  me  what  you 
did  without  referencing  those  particular  documents . 

THE  WITNESS:     Ma'am  basically  conducted  a 
search  using  I  believe  the  words  the  most  wanted  leaks 
of  2009  using  Google.      There  were  numerous  results  that 
came  as  a  result  of  that  search  and  the  first  I  believe 
it  was  the  first  four  contained  three  versions  of  this 
list  or  similarities  to  this  list  and  the  prosecution 
Exhibit  110  is  one  version  of  that  list. 

I  guess  defense  Exhibit  —  excuse  me, 
fox  trot  is  another  version  of  this  list,    and  there 
was  additionally  a  third  shorter  version  as  well  as 
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a  video  related  to  the  list . 

THE  COURT :     And  did  you  print  —  you 
printed  both  versions  yourself,  right? 

THE  WITNESS:      I  believe  I  printed  all  three 

versions . 

THE  COURT :      Thank  you .  Government 
objection  is  authentication  and  I  admit  Prosecution 
Exhibit  110.     What's  the  basis  for  admission  on  the 
authentication? 

CAPTAIN  MORROW:  Your  Honor,  the  objection 
is  relevance.  I'm  not  sure  what  the  relevance  of  this 
specific  exhibit  is . 

THE  COURT:     Well,    if  prosecution  Exhibit 
110  is  relevant  why  isn't  this  one  relevant? 

CAPTAIN  MORROW:      The  foundation  for  this 
one  might  be  relevant.     Additionally,   Your  Honor,  we'd 
also  object  on  the  basis  of  hearsay.     What  are  they 
offering  it  for? 

THE  COURT:      Go  ahead. 

CAPTAIN  TOOMAN:     Would  you  like  me  to 
respond  to  that? 
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THE  COURT:     Yes,  please. 

CAPTAIN  TOOMAN:     Your  Honor,    I  guess  most 
notably  admitted  there ' s  the  exact  same  thing  done  the 
exact  same  way  so  it  should  be  admissible.  With 
respect  to  hearsay  we  would  say  rule  106  completeness 
if  this  is  basically  the  same  version.      If  you  look  at 
you  recall  it  is  identical  with  the  exception  of  a 
hyphen  sort . 

THE  COURT:     Are  the  same  URL  with  the 
exception  of  the  hyphen  sort,   we  need  to  put  that  on 
the  two  exhibits . 

You  pulled  it  up,   you  got  —  normally 
when  you  search  Google  something  you  get  a  list  of 
things . 

THE  WITNESS:     Yes,  ma'am. 

THE  COURT:      So  they  listed  one,   two,  three, 

four  or? 

THE  WITNESS :      There  was  —  I  believe  there 
was  ten  results  as  a  result  of  the  search  on  the  page 
initially  the  Google  results  and  then  within  the  first 
four  results  were  different  versions  of  this  list,  and 
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these  are  two  versions  of  that  list . 

THE  COURT:      I'm  going  to  overrule  the 
objection.     Anything  else? 

CAPTAIN  MORROW:      We    (INAUDIBLE)    assume  the 
truth  of  the  statement  or  the  truths  of  the  statement . 

THE  COURT:     Why  does  the  rule  of 
completeness  assume  the  rule  of  completeness? 

CAPTAIN  MORROW:  (INAUDIBLE) 

THE  COURT:     Rule  106  do  formal 
(INAUDIBLE)   be  one  document  if  part  of  the  document 
that ' s  admitted  than  you  decide  to  bring  in  the  rest 
of  the  document . 

CAPTAIN  MORROW:     May  I  ask  him  a  couple  of 
questions  about  the  difference  of  the  document? 

THE  COURT:      Go  ahead. 

BY  CAPTAIN  MORROW: 
Q  Agent  Mander,    you  said  that  you  searched 

for  Wikileaks  most  wanted  and  came  up  with  a  number  of 
results? 

A  Yes . 

Q  What  does  that  mean  when  a  number  of 
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results  come  up? 

A  Could  you  be  more  specific. 

Q  Were  they  in  the  same  location  on  the 

Internet? 

A  Both  documents  were  on  the  Wikileaks.org 

website . 

Q  But  it  wasn't  exactly,   you  had  to  navigate 

from  that  website  to  another  place  on  the  website;  is 
t  hat  co  r r e  ct  ? 

A  When  I  initially  went  to  the  main 

Wikileaks.org  recently  on  June  first  you  could  not 
directly  navigate  to  either  one  of  these  litigations. 
Q  But  the  —  okay . 

CAPTAIN  MORROW:     No  further  questions. 

THE  COURT :     Now  I ' m  confused  again .  You 
printed  out  those  documents  and  they  say  June  1st .  How 
would  you  print  them  out  if  you  never  got  them? 

THE  WITNESS :     When  I  used  Google  I  used  the 
search  term  the  most  wanted  leaks  of  2009.  That 
resulted  in  numerous  search  results .     These  were  two  of 
those  results.      If  you  go  to  the  Wikileaks.org  website 
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directly  without  searching  for  it  there  are  many  links 
and  other  various  bits  of  information  on  this  page, 
however,   there  is  nothing  that  will  immediately  take 
you,    or  nothing  you  can  click  on  that  will  take  you  to 
either  one  of  these  lists,   their  main  web  page,  their 
home  page . 

Does  that  make  it  any  clearer,  ma'am? 

THE  COURT :      Let  me  just  make  sure  I 
understand  your  testimony.     You  went  on  Google  and  this 
isn't  Google  cache,   this  is  just  Google? 

THE  WITNESS:      Just  Google. 

THE  COURT:     And  you  found  the  difference 
between  fox  trot  and  prosecution  110  in  your  search? 
THE  WITNESS:     Yes,  ma'am. 

THE  COURT :     And  they  come  up  two  of  the  ten 
results  that  you  found? 

THE  WITNESS:     Yes,  ma'am. 

THE  COURT:     And  then  if  on  June  1st  —  and 
you  printed  it  ought  off  Google? 

THE  WITNESS:      I  printed  it  off  the  actual 
location  where  the  documents  occurred. 
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THE  COURT :     And  then  you  went  to  the 
Wikileaks  website  and  accessed  them  that  way? 

THE  WITNESS :     You  cannot  navigate  to  them 
from  the  home  page  of  the  Wikileaks.org  website, 
meaning  you  could  not  click  on  anything  on  that  home 
image  that  would  take  you  to  these  documents . 

THE  COURT:      I  think  I  understand.  All 

right . 

THE  WITNESS:      If  I  may  expound  on  that.  I 
believe  there  was  a  question  in  regards  to,   could  the 
general  public  find  these  on  the  Wikileaks  website  just 
by  going  to  the  main  website  and  presumably  they 
wouldn't.      They  would  find  them  doing  a  search,   but  not 
going  to  the  website  directly. 

THE  COURT:     Okay.      I'm  still  in  the  same 
position  I  was  in  before  Prosecution  Exhibit  110  comes 
in . 

CAPTAIN  MORROW:     We'll  withdraw  the 

objection . 

THE  COURT:      To  the    (INAUDIBLE)    has  the  same 
rulings .      It ' s  admissible .     Do  you  want  to  give  it  to 
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me,    I'll  admit  it. 

CAPTAIN  TOOMAN:     Retrieve  defense  Exhibit 
fox  trot  and  Prosecution  Exhibit  110  for  the  witness, 
and,    Your  Honor,    that's  exhibit  fox  trot  and  I'm  going 
to  hang  onto  this . 

THE  COURT:     Exhibit  fox  trot  is  admitted. 

CAPTAIN  TOOMAN:     Ma'am,   permission  to 
publish  Prosecution  Exhibit  110. 

THE  COURT:      Go  ahead. 

BY  CAPTAIN  TOOMAN: 
Q  I'm  placing  on  the  overhead  Prosecution 

Exhibit  110,   page  9.     Agent  Mander,    you  spoke  on  direct 
about  a  number  of  Intel  Link  searches  that  you  found 
that  corresponded  to  things  on  Prosecution  Exhibit  110, 
correct? 

A  I  did  not  actually  find  the  Intel  links 

searches.     That  was  someone  else  from  the  forensics 
team. 

Q  You  look  at  the  Intel  Link  searches  and 

testified  that  some  of  the  things  —  the  terms  searched 
were  items  that  were  similar  to  things  on  Prosecution 


Provided  by  Freedom  of  the  Press  Foundation 


1 

2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 


UNOFFICIAL  DRAFT  -  6/10/13  Afternoon  Session 

114 

Exhibit  110,  correct? 

A  That ' s  correct . 

CAPTAIN  TOOMAN:     At  this  time  I'd  like  to 
retrieve  Prosecution  Exhibit  81  and  ask  the  witness  to 
move  to  the  panel  box. 

THE  COURT :      All  right . 

BY  CAPTAIN  TOOMAN: 
Q  I'm  handing  the  witness  what's  marked  as 

Prosecution  Exhibit  81 . 

Agent  Mander,   what  I'd  like  to  do  is  we're 
going  to  go  through  this  list  and  I ' d  like  you  to  tell 
me  whether  or  not  there  are  any  searches  in  Prosecution 
Exhibit  81  that  correspond  with  the  item  on  the  list. 
Okay? 

CAPTAIN  MORROW:     Your  Honor,   the  government 
will  stipulate  to  that.      There  are  no    (INAUDIBLE) . 

THE  COURT:     What  do  you  want  him  to  do? 

CAPTAIN  TOOMAN:     Your  Honor,   the  government 
highlighted  I  think  three  instances  where  PFC  Manning, 
or,    rather,    I  should  say,    computers  associated  with  PFC 
Manning  searched  for  terms  that  correspond  with  items 
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listed  on  this  list . 

THE  COURT :     You  want  to  go  through  all  of 
the  ones  where  they  don't  correspond,    and  government 
you're  willing  to  stipulate  the  those  three  are  the 
only  ones  that  correspond? 

CAPTAIN  MORROW:     Yes,    Your  Honor. 

THE  COURT:      In  light  of  that,    do  you  need 

to  continue? 

CAPTAIN  TOOMAN:     No,   ma'am.      I  will 
retrieve  Prosecution  81  from  the  witness.      I'll  hand 
that  back  to  the  government . 

BY  CAPTAIN  TOOMAN: 
Q  Agent  Mander,    if  you  would  please  return  to 

the  witness  stand.  I'm  going  to  hand  you  Prosecution 
110,  and  I'd  like  for  you  to  count  how  many  items  are 
listed  in  that  exhibit,  please? 

A  Could  you  define  the  word  item? 

Q  I'm  sorry,    under  the  United  States.  I 

think  it  starts  on  page  9 . 

A  (Witness  reviewing  document.) 

You  say  items  there  are  bullets. 
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CAPTAIN  TOOMAN:  I'll  retrieve  the  exhibit 
from  the  witness  and  I  will  publish  this  if  that ' s  all 
right  with  Your  Honor? 

THE  COURT:      That's  fine. 
BY  CAPTAIN  TOOMAN: 
Q  Page  9  of  Prosecution  Exhibit  110 .  So 

Agent  Mander,    if  you  could  please  count  the  items  on 
under  United  States  there? 

A  Can  you  move  it  down  a  little  bit? 

Q  Sure .      This  way? 

A  Yes,    that's  fine. 

Q  Okay . 

A  When  you  say  items,   we're  talking  about  the 

bulleted  items,   the  subbullets? 
Q  Yes . 

A  They're  at  least  five  things  that  I  can  see 

different  categories,    I  guess  you  could  say. 

Q  Let ' s  go  with  important  bulk  databases . 

How  many  items  are  listed  under  important  bulk 
databases? 

A  There  are  three  categories  of  items . 
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Q  The  next  is  federal  politics? 

A  Correct . 

Q  How  many  items  are  listed  there? 

A  There  are  six. 

Q  Okay .     And  then  next  do  you  see  military 

intelligence.      I'm  going  to  move  this  up  so  we  can  see 
all  of  that  subsections.     And  if  you  could  please  count 
I  think  on  here  count  each  bullet  and  subbullet  — 
would  you  agree  with  me  that  the  subbullet s  are 
different  than  the  main  bullet? 

A  Sure,  yes. 

Q  Or  unique  in  some  way? 

A  Yes . 

Q  In  you  would  count  those  bullets  for  me . 

A  Appears  to  be  21  bullets  there. 

Q  Okay.     And  I'm  now  going  to  remove  page  9 

of  the  exhibit  and  put  on  page  10  to  the  overhead.  Can 
you  see  that  okay,   Agent  Mander? 

A  Yes. 

Q  We're  still  under  military  intelligence. 

So  we're  continuing  from  21? 
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A  (Witness  reviewing  document . ) 

Fifty-five  excuse  me  56. 
Q  Fifty— six  visibles  on  the  screen  there? 

A  Yes . 

Q  And  the  last  one  you  see  just  for  the 

record  is  blueprints  and  floor  plans  of  all  unmentioned 
facility  in  the  federal  relocation  arc  including 
historical  ones? 

A  That ' s  correct . 

Q  So  54  to  there  under  military  and 

intelligence,  correct? 

A  Didn't  I  say  56? 

Q  I'm  sorry,    56.      I'm  now  moving  page  10  up. 

How  many  under  banking? 

A  There  two  bulleted  items . 

Q  And  one  under  environment? 

A  That  is  correct . 

Q  And  two  under  media? 

A  That  is  correct . 

Q  And  two  under  religion? 

A  That  is  correct . 
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Q  I'm  removing  page  10  and  placing  page  11  on 

the  overhead  and  will  continue  with  religion.     How  many 
more  do  you  have  there? 

A  There  are  six  more  on  this  page. 

Q  I'm  removing  page  11  and  returning 

Prosecution  Exhibit  110  to  the  court  reporter. 

CAPTAIN  TOOMAN:     No  further  questions,  Your 

Honor . 

THE  COURT:  Redirect? 

CAPTAIN  MORROW:     No,    Your  Honor. 

THE  COURT :      Temporarily  excuse  or 
permanently  excuse    (INAUDIBLE) . 

CAPTAIN  MORROW:      Temporary,    Your  Honor. 

THE  COURT :     Agent  Mander ,   you ' re 
temporarily  excused.     Don't  discuss  your  testimony  or 
knowledge  of  the  case  with  anyone  other  than  counsel 
(INAUDIBLE) .     You  can  step  down. 

The  presentation  of  your  case  the  next 
piece  of  it  is  stipulated  of  expected  testimony  or 
is  it  a  witness? 

MAJOR  FEIN:      The  witness  is  sitting  right 
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out  here  ready  to  go . 

THE  COURT:     A  long  or  a  short  witness? 
MAJOR  FEIN:     United  States  thinks  pretty 

short . 

THE  COURT :     Does  either  side  have  any 
objection  to  continuing? 

MR .   COOMBS :     No ,   Your  Honor . 

MAJOR  FEIN:      The  United  States  calls 
Ms .    Sheila  Glenn . 
Whereupon, 

SHEILA  GLENN, 

called  as  a  witness,   having  been  first  duly  sworn  to 
tell  the  truth,    the  whole  truth  and  nothing  but  the 
truth,   was  examined  and  testified  as  follows : 

DIRECT  EXAMINATION 
BY  CAPTAIN  OVERGAARD: 
Q  And  you  are  Sheila  Glenn? 

A  Yes,    I  am. 

Q  You  work  at  Fort  Meade,  Maryland? 

A  Yes,    I  do. 

Q  What  unit  do  you  work  for  at  Fort  Meade? 


Provided  by  Freedom  of  the  Press  Foundation 


1 

2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 


UNOFFICIAL  DRAFT  -  6/10/13  Afternoon  Session 


121 

A  I  work  for  Army  counterintelligence 

( INAUDIBLE)    center . 

Q  And  what  is  a  MI  (INAUDIBLE)? 

A  (INAUDIBLE)    current  counterintelligence 

activities  to  the  protect  classified  information  and 
technologies  and  to  detect,  identify  foreign  threats 
against  U.S.   Army . 

Q  And  do  you  work  for  a  particular  subgroup 

under  that? 

A  Yes ,    I  do .      I  work  for  the  Army 

counterintelligence  Center. 

Q  What  is  the  Army  Counterintelligence 

Center? 

A  Army  Counterintelligence  Center  produce 

timely  accurately  comprehensive  multi— discipline 
analysis  to  support  combat  terrorism  programs,  ground 
system  technologies,   and  investigation  operation 
activities . 

Q  And  do  you  work  for  a  specific  branch  under 

the  Army  Counter  — 

A  Yes ,    I  do . 
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Q  What  branch  is  that? 

A  I  work  form  cyber  counterintelligence 

assessment  branch. 

Q  And  what  does  a  cyber  counterintelligence 

assessment  branch  do? 

A  That  counter  cyber  intelligence  assessment 

branch  identifies  and  performs  analysis  on  cyber 
counterintelligence  threats  to  the  United  States  Army. 

Q  And  what  is  your  job  at  the  Army  at  the 

cyber  counterintelligence  branch? 

A  My  job  is  the    (INAUDIBLE)    certain  analysts 

and  my  job  is  to    (INAUDIBLE)    and  also  soldiers  and  also 
to  edit  and  review  documents  for  content,  accuracy, 
and. 

Q  How  many  analysts  do  you  have  there? 

A  We  have  five  analysis  that  work  under  me . 

Q  How  long  have  you  been  in  that  senior 

analyst  position? 

A  I've  been  in  that  position  for  two  years. 

Q  How  long  have  you  been  with  the 

(INAUDIBLE) ? 
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A  Since  2000. 

Q  What  did  you  do  before  that? 

A  I  was  in  military  for  20  years  and  I 

retired  as  Sergeant  First  Class. 

Q  What  did  you  do  in  the  military? 

A  I  spent  five  years  as  a  crypto  (INAUDIBLE) 

equipment  repair,    15  years  as  an  intelligence  analyst. 

Q  What  kind  of  intelligence  analyst? 

A  All  source  intelligence  analyst . 

Q  And  what  has  been  your  focus  at  the  907 . 

You  said  you're  under  the  cyber  assessments  branch? 

A  My  focus  is  cyber  counterintelligence. 

Q  And  what  does  that  mean? 

A  That  means  that  I  look  at  the  foreign  cyber 

threat,    identify  and  assess  that  threat  to  throat 
United  States  Army  technologies  and  programs . 

Q  What  sorts  of  —  you  say  there  are  five 

analysts  that  work  would  under  you? 

A  Yes . 

Q  What  sorts  of  work  product  do  the  cyber 

analysts  in  the  cyber  CI  branch  of  A6  produce? 
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A  The  cyber  CI  analyst  produce  special 

reports,   counterintelligence  notes,    input  the  system 
and  input  the    (INAUDIBLE)    cyber  inputs. 

Q  We'll  just  focus  on  the  A6  special  reports 

prepared  by  the  cyber  CI  branch.     Can  you  tell  us  how 
that  one  is  distinct  from  the  other  ones  that  you 
named? 

A  The  A6  special  report  is  a  comprehensive 

document .      It  uses  I  the  full  spectrum  analysis  and  it 
uses  predictive  analysis. 

Q  And  are  they  different  types  of  these 

special  A6  reports? 

A  Basically  A6  special  reports  based  on 

requirements,    request  of  information,  or 
self-initiated . 

Q  What's  the  purpose  of  this  self-initiated 

cyber  CI  special  report? 

A  In  a  self —initiated  report  we  identify 

potential  threat  to  U.S.  Army  and  we  inform  the 
commander  about  that  treat  to  the  organization. 

THE  COURT :     You  said  there  are  three  of 
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them,    requirements,    something  else  and? 

THE  WITNESS:     Request  information. 

THE  COURT :      Thank  you . 

BY  CAPTAIN  OVERGAARD: 
Q  Just  focusing  in  on  the  self-initiating 

cyber  CI  special  reports,    can  you  tell  us  how  those  are 
prepared? 

A  Our  first  analyst  comes  up  while  doing 

their  research  they  come  across  some  information  that 
they  think  might  be  of  a  CI  interest  in  the  United 
States  Army.      If  it  is,   then  they  talk  about  it  with 
their  supervisor  and  see  if  there's  something  that,  you 
know,   the  supervisor  will  approve  for  them  to  go  ahead 
and  produce . 

So  then  an  analysts  list  what  they  know  and 
what  they  don't  know  about  that  event  or  organization 
or  whatever  their  writing  about.     Once  they  look  at 
what  they  have  and  what  they  don't  have,   then  they 
start  doing  research .     They  do  the  research  on 
classified  and  unclassified  reporting. 

Q  Where  do  they  conduct  this  research? 
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A  They  conduct  this  research  on  classified 

systems,   SIPRnet  and  unclassified  systems. 

Q  What  kinds  of  things  are  they  looking  at 

when  they  are  conducting  their  research? 

A  They ' re  looking  at  everything .      They ' re 

looking  at  human  reporting,  they're  looking  at  a  lot 
(INAUDIBLE)    imagery  reporting  and  massive  reporting. 

Q  So  after  they  —  after  an  analyst  does  this 

research,   what's  the  next  step  to  in  creating  the 
self-initiating  special  report  for  cyber  CI? 

A  Once  they  finish  their  research,  the 

analyst  look  at  the  order  of  the  stuff  they  want  to 
compile .     So  basically  they  do  the  outline  and  they  put 
the  information  that  they  collected  within  that  outline 
and  then  they  need  to  answer  the  questions,   the  who, 
what,   why,   where,   and  how,   and  then  they  want  to  see 
what ' s  next  and  then  they  also  look  at  the  impact 
against  U.S.   Army  interests  and  U.S.  interests. 

Q  And  then  do  they  —  when  do  they  start 

writing  the  product? 

A  After  they  collect  all  the  information  and 
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put  it  into  the  outline  then  they  start  writing  the 
product . 

Q  And  after  —  I  guess  what ' s  the  process 

then  for  writing  that  product? 

A  Okay.     For  writing  the  product  you  pull  all 

intelligent  information  together.     You  look  at  the 
impact .     You  go  through  the  information  and  then  you 
put  it  in  a  template .     Template  you  have  a  template  for 
these  reports .     You  put  it  in  a  template  and  make  sure 
that  you  can  answer  all  the  who,   what,   why,   where,  and 
what ' s  next . 

Q  And  after  that  report  is  drafted,  what 

happens  to  it? 

A  After  the  report  is  drafted  it  goes  to  the 

senior  analyst  who  reviews  it  for  content,  accuracy, 
and  grammar,   and  once  they  senior  analyst  reviews  it, 
then  it  goes  out  for  coordination,  external 
coordination . 

Q  I'm  going  to  step  back  a  little  bit. 

What ' s  the  content  and  accuracy  verification?  What 
does  that  entail? 
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A  When  we  look  at  it  for  content  and 

accuracy,   we're  making  sure  that  information  within  the 
report  is  correct .     We  fact  check  the  sources  that  are 
used  in  the  report  to  make  sure  that  they  agree  with 
the  information  within  the  report  states  and  then  we 
check  for  grammar . 

Q  And  then  you  said  you  send  it  out  for 

coordination? 

A  Yes. 

Q  What  does  that  mean? 

A  When  we  send  it  out  to  coordination  to 

external  sources,   we  send  it  to  other  intelligence 
agencies  so  they  can  actually  review  the  report  to  make 
sure  that  have  the  information  accurately. 

Q  And  what  happens  after  the  external 

coordination? 

A  When  we  did  get  our  results  back  from  the 

external  coordination  by  checking  the  comments  that  the 
organizations  put  within  the  report  and  if  we  agree 
with  the  comments  then  we  incorporate  them  within  the 
reports .      If  we  disagree  with  the  comments  then  we  put 


Provided  by  Freedom  of  the  Press  Foundation 


1 

2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 


UNOFFICIAL  DRAFT  -  6/10/13  Afternoon  Session 


129 

an  alternative  analysis  statement  in  that  report . 
Q  Is  that  required? 

A  Yes,    it  is. 

Q  And  what  happens  after  the  external 

coordination,   what  happens  to  the  product  next? 

A  External  coordination  of  the  products 

reviewed  by  the  branch  chief . 

Q  It  goes  —  what,   if  anything,    is  new  added? 

A  If  anything  is  new  added  it  goes  back  to 

the  field  analyst  who  reviews  that  information  and  then 
it  goes  to  the  branch  chief . 

Q  What  does  a  branch  chief  do? 

A  The  branch  chief  reviews  the  product  again 

for  content,   accuracy,   and  grammar. 

Q  What  happens  after  that? 

A  After  the  product  is  reviewed  by  the  branch 

chief  then  it  goes  to  the  editors  for  them  to  review 
it. 

Q  Again,    for  content  and  accuracy? 

A  They  review  it  for  grammar  and  content  — 

grammar  and  accuracy .      They  don ' t  review  it  for 
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accuracy,   they  review  it  for  grammar. 

Q  So  what  happens  after  the  editing  is  done? 

A  Once  the  editors  finish  their  job  then  it 

goes  to  the  director  or  deputy  director  for  review  for 
content,   accuracy,   and  grammar. 

CAPTAIN  OVERGAARD:     Your  Honor,    I'm  going 
to  retrieve  prosecution  45  for  identification. 
BY  CAPTAIN  OVERGAARD: 

Q  I'm  handing  Prosecution  Exhibit  45  for 

identification  to  the  witness.      Can  you  tell  us  what 
that  is? 

A  It ' s  a  A6  special  report . 

Q  How  do  you  know  that? 

A  Because  it  states  on  the  top  of  the 

document  A6  special  report  and  it  has  an  A6  serial 
number  on  it . 

Q  And  you're  familiar  with  those  documents? 

A  Yes,    I  am. 

Q  How  are  you  familiar  with  it? 

A  We  write  them. 

Q  Have  you  written  them  yourself? 
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A  Yes ,    I  have . 

Q  And  what  type  of  product  is  in  that 

document  or  is  that  report  in  particular? 

A  This  is  a  self —initiated  document . 

Q  And  who  wrote  that  product? 

A  Ms.   Mike  (INAUDIBLE). 

Q  Who  is  Mike  Corvat? 

A  He  was  the  senior  analysis  at  the  time. 

Q  What  was  your  involvement  in  creating  that 

product  ? 

A  Mike  discussed  the  subject  with  me  and  I 

reviewed  it  for  content  and  grammar  and  accuracy . 

Q  So  you're  familiar  with  the  content? 

A  I'm  familiar  with  the  content,  yes. 

Q  And  why  did  you  review  the  product? 

A  Because  we  have  a  two  review  process  within 

our  organization. 

Q  Is  this  a  product  you  reviewed  in  2008? 

A  Yes,    it  is. 

Q  Is  it  different  in  any  way? 

A  Yes,    it  is. 
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Q  How  is  it  different? 

A  It's  been  declassified  and  is  missing 

notes . 

Q  Is  the  content  otherwise  the  same? 

A  Yes,    it  is. 

Q  And  what  happened  to  the  product,  what 

happened  to  this  product  in  particular  after  it  went 
through  the  process  that  you  discussed  before? 

A  It  was  posted  to  our  website. 

Q  Where  is  your  website? 

A  On  SIPRnet  and  JWICS . 

Q  Is  that  product  still  on  the  — 

A  Yes,    it  is. 

Q  How  do  you  know  that? 

A  I  checked  it . 

Q  (INAUDIBLE)   United  States  moved  to 

admission  what  has  been  marked  as  Prosecution 
Exhibit  45  for  identification  into  evidence  as 
Prosecution  Exhibit  45 . 

CAPTAIN  TOOMAN:     No  objection,    Your  Honor. 

THE  COURT:     May  I  see  it,  please? 
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Prosecution  Exhibit  45  for  identification  is  admitted. 
Does  the  witness  need  the  document  back? 

CAPTAIN  OVERGAARD:     Yes,  ma'am. 
BY  CAPTAIN  OVERGAARD: 
Q  Ms.   Glenn,    can  you  tell  us  the  name  of  that 

product  that  I  handed  you? 

A  Wikileaks.org  on— line  reference  to  foreign 

intelligence  services  or  insurgents  or  terrorist 
groups . 

Q  What  is  that  letter  and  number  combination 

under  the  title? 

A  There  is  the  production  center,    first  four 

digits,   the  second  is  the  function  code,   the  third  is 
the  serial  number,   and  the  last  is  the  fiscal  year. 

Q  And  under  that  what  is  the  publication  date 

of  this  document? 

A  18  March  2008. 

Q  And  how  about  the  information  cutoff  date? 

A  28th  February  2008. 

Q  Can  you  tell  us  what  the  information  cutoff 

date  means? 
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A  That ' s  the  last  current  reporting  that ' s 

contained  in  this  report . 

Q  What  does  it  say  under  the  publication 

date? 

A  Last  security  information,  unauthorized 

disclosure  subject  to  criminal  sanctions . 

Q  What  is  the  national  security  information? 

A  Information  that  has  been  determined  that 

it  needs  to  be  protected  from  unauthorized  release. 

Q  What  specifically  types  of  national 

security  information  is  in  here? 

A  Intelligence  reports  produced  by 

originators . 

Q  And  you  already  us  what  the  external 

coordination  means,   but  can  you  tell  us  what  that  line 
represents? 

A  The  coordination? 

Q  Yes . 

A  The  organization  that  perform  the  external 

coordination . 

Q  So  that  it  was  sent  to  you  to  coordinate 
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with? 

A  Yes . 

Q  And  how  about  that  next  line?     Can  you  tell 

us  what  that  means? 

A  Which  one? 

Q  The  product  response  to  headquarters, 

Department  of  Army? 

A  —  that's. 

THE  COURT:      Can  we  move  this  so  you  can 
follow  along. 

CAPTAIN  OVERGAARD:     Yes,   ma'am.      I  can 
publish  a  copy  that  I  have  right  here,  ma'am. 
BY  CAPTAIN  OVERGAARD: 
Q  We ' re  at  the  line  beginning  this  product . 

Can  you  just  tell  us  again  what  that  means? 

A  That's  the  production  requirement  that  was 

used  to  produce  this  document,   to  authorize  the 
production  of  this  document . 

Q  And  then  how  about  that  last  line  there 

that  says  A6  production  or  product  identification. 
What  does  that  mean? 
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A  That ' s  the  A6  serial  number  of  that 

product . 

Q  Does  that  serial  number  have  any  specific 

meaning? 

A  The  Army  designates  A6,    the  08  is  the 

fiscal  year,   and  the  serial  number  is  the  same  as  the 
one  above    (INAUDIBLE)    the  system  numerical  order  of  the 
reports . 

Q  So  there's   just  — 

A  One,    two,    three,    four,    five,    six  on  up. 

Q  And  you  mentioned  before  that  you  have 

templates  for  your  documents? 
A  Yes ,   we  do . 

Q  What  is  the  template  for  this  document? 

A  The  template  for  this  document  is  the 

title,   purpose,   executive  summary,   key  judgments 
background,    discussion,    conclusion  intel  gaps, 
conclusion,    and  contact. 

Q  Intel  gaps  and  conclusions? 

A  And  point  of  contact . 

Q  In  2008  that  was  a  template  you  used? 
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A  Yes,    in  2008  that  was  the  template  we  used. 

Q  Can  you  just  tell  us  a  little  bit  about  how 

this  self-initiated  product  was  prepared,  this  specific 
product  ? 

A  This  product  was  doing  research  and  came 

across  Wikileaks.org  and  he  thought  it  was  a  CI 
concern . 

CAPTAIN  TOOMAN:     Objection.      This  witness 
would  have  no  personal  knowledge  of  what  prompted 
Mr .   Horbach  to  write  this  document . 

BY  MS.  OVERGAARD: 
Q  Are  you  testifying  to  your  personal 

knowledge? 

A  Yes,    I  am,   because  I  discussed  this  with 

Mr.   Horbach  during  that  time  frame. 

CAPTAIN  TOOMAN:     We  would  object  based  on 

hearsay . 

THE  COURT :     What ' s  the  relevance 

(INAUDIBLE) . 

CAPTAIN  OVERGAARD:     One  moment,  please, 
Your  Honor.     Ma'am,   we'll  stick  with  her  personal 
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observation  and  not  any  objection. 

THE  COURT:     Objection,  sustained. 
BY  CAPTAIN  OVERGAARD: 
Q  Can  you  tell  us  what  specifically  was  done 

to  create  this  self-initiated  product? 
A  The  steps? 

Q  Yes . 

A  The  — 

Q  The  steps  that  Mr .   Horbach  took  and  the 

steps  that  you  took  in  assisting  him? 

A  Mr .   Horbach  used  the  same  procedures  that  I 

talked  about  before.      I  assisted  in  research  and  in 
reviewing  and  editing  the  document . 

Q  And  are  these  documents,   are  they  usually 

32  pages  long? 

A  The  documents  can  be  much  smaller,  five 

pages,   or  they  can  be  much  larger,    150  pages. 

Q  What's  the  average,   what  are  they  usually? 

A  Average  usually  about  20  to  30  pages. 

Q  And  let ' s  talk  a  little  bit  about  the 

content  of  this  report .     Do  you  know  what  the  purpose 
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of  this  document  is? 

A  Yes .      The  purpose  of  this  document  was  to 

assess  the  counterintelligence  threat  on  the  U.S.  Army 
by  Wikileaks.org  website. 

Q  According  to  the  report  and  your  knowledge 

of  the  report,   what  is  Wikileaks? 

A  Wikileaks  is  a  organization  that  exposes 

illegal  activity. 

CAPTAIN  TOOMAN:     Objection,    Your  Honor.  I 
don't  believe  this  witness  is  in  a  position  to 
determine  the  legality  of  the  Wikileaks    (INAUDIBLE) . 

CAPTAIN  OVERGAARD:      She's  testifying  about 
what  the  product  actually  says . 

THE  COURT:     All  right.      I'm  not  taking  her 
testimony  to  be  a  legal  opinion  of  whether  something  is 
legal  or  illegal .      I'll  take  it  to  what  purports  to  be 
illegal  activity.     Go  ahead. 

CAPTAIN  OVERGAARD:      The  purpose  of 
testimony  is  only  to  elicit  what  is  actually  in  the 
document  not  what  Wikileaks  is  or  is  not,   but  what  is 
written  in  the  document . 
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THE  COURT:  Go  ahead. 
BY  CAPTAIN  OVERGAARD: 

Q  Can  you  tell  us  what  Wikileaks  is  according 

to  this  report? 

A  According  to  the  report,    it  says  that  intel 

of  Wikileaks  website  is  to  expose  unethical  practices 
and  illegal    (INAUDIBLE)    and  wrongdoing  with  respect  to 
corrupt  corporations  and  governments . 

Q  And  does  the  report  comment  on  whether  or 

not  Wikileaks  is  a  news  organization? 

A  Yes,    it  was. 

Q  And  what  does  it  say? 

A  It  says  that  Wikileaks . org  is  not 

considered  a  news  organization. 

Q  And  does  it  give  some  reasons  for  that? 

A  Yes,    it  does.      It  says  that  Wikileaks  does 

not  vet  their  sources .     Wikileaks  does  not  put  out 
overview.     Wikileaks  does  not  provide  source  checking 
or  fact  checking,    and  Wikileaks  does  not  provide  — 
Wikileaks  does  not  confirm  the  accuracy  of  the 
information . 
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Q  Does  it  talk  about  how  Wikileaks  releases 

information? 

A  Yes,    it  does. 

Q  What  does  it  say  about  that? 

A  It  says  Wikileaks . org  uses  anonymous 

methods  to  post  the  information  to  the  sites .      It  says 
Wikileaks.org  uses  its  own  code  and  software  which  can 
open  SSF    (INAUDIBLE)    difficult  for  foreign  governments, 
law  enforcement  agencies,   and  foreign  businesses  to 
determine  where  a  leak  document  was  and  who  was 
responsible  for  leaking  the  document . 

Q  Can  you  tell  us  what  page  you ' re  looking 

at? 

A  I'm  looking  at  page  5 . 

Q  What  paragraph  was  that? 

A  Paragraph  3 . 

Q  Does  it  talk  about  —  does  this  product 

further  talk  about  what  type  of  behavior,  this 
anonymous  releasing  encourages? 

A  Yes .      The  document  says  that  the  anonymous 

behavior  encourages  —  let  my  get  the  exact  words . 
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It  says  that  the  Wikileaks.org  is  normally 
(INAUDIBLE)    activities  such  as  a  theft  of  data, 
documents,   proprietary  information  and  intellectual 
property,   possible  violations  of  national  security  laws 
regarding,   espionage  and  possibly  a  violation  of  civil 
laws  in    (INAUDIBLE)   within  the  United  States  and 
foreign  countries . 

Whistle  blowers  are  in    (INAUDIBLE)  violate 
laws    (INAUDIBLE)   whistle  blowers  protected  from 
retaliation    (INAUDIBLE)   that  in  countries  that  have 
such  laws  on  page  20. 

Q  What  paragraph  on  page  20  were  you  looking 

at? 

A  Page  20,   paragraph  1. 

Q  This  one  or  that  one? 

A  That  one . 

Q  Okay.     The  top  paragraph,   the  half 

paragraph? 

A  Page  19  it  starts. 

Q  According  to  this  what  threat  does 

Wikileaks  pose? 
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A  Wikileaks    (INAUDIBLE)    first  protection 

cyber  intelligence  —  first  protection, 
counterintelligence,    information  security,  and 
operation  security  threat . 

Q  That's  in  the  key  judgments? 

A  Yes,    it  is. 

Q  And  what  else  or  what  does  the  key  judgment 

say  about  how  it  does  this,   how  Wikileaks  does  this, 
just  looking  at  key  judgments  on  page  3? 

A  Okay.      It  says,    recent  on-line  espionage 

release  of  DoD  and  sensitive  and  classified  information 
provided  foreign  terrorists  groups  and  insurgents  and 
other  foreign  adversaries  with  potentially  actionable 
information  for  targeting  U.S.  forces. 

Q  Does  the  report  discuss  any  examples  of 

information  that  are  posted  on  Wikileaks? 

A  Yes .      This  report  has  three  examples . 

Q  What  were  those  three  examples? 

A  The  first  example  was  the  release  of 

(INAUDIBLE)    for  troops  deployed  in  Iraq  and 
Afghanistan.     The  second  example  was  release  of  a 
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standard  operation  procedures  for  joint  task  force. 
The  third  example  was  a  classified  document  released 
that  is  produced  by  national  ground  intelligence 
center . 

Q  What  information  in  particular  according  to 

this  report  was  in  the  TONE,   the  table  of  equipment 
that  you  just  mentioned? 

A  Report . 

Q  Just  in  general  what  is  in  the  TONE? 

A  The  TONE  had  a  list  of  all    (INAUDIBLE)  that 

was  deployed  in  Afghanistan  and  in  Iraq. 

Q  And  did  the  products  say  anything  about  the 

dangers  of  releasing  that  information? 

A  Yes.      It  said  that  the  products  stated  that 

the  release  of  that  information  could  allow  foreign 
intelligence  service  terrorist  groups,    Iraqi  insurgents 
to  conduct  attacks  against  U.S.   Army    (INAUDIBLE) . 

CAPTAIN  TOOMAN:     Relevance,    Your  Honor. 
THE  COURT:     What  is  the  relevance? 
CAPTAIN  OVERGAARD:      It's  relevant  to  the 
accused ' s  knowledge . 
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THE  COURT:     All  right.  Overruled. 
BY  CAPTAIN  OVERGAARD: 
Q  You  can  continue . 

A  The  identification  of  vehicles,  military 

vehicles,    could  be  used  to  select  specific  types  and 
replacements  of  improvised  explosive  devices . 

Q  And  then  you  also  mentioned  that  there  was 

a  national  ground  intelligent  report? 

A  Yes,    it  is. 

Q  What  did  that  contain? 

A  That  report  discussed   (INAUDIBLE)  warfare 

welfare  and  used  against  U.S.    (INAUDIBLE) . 

Q  And  what  was  the  classification  of  that 

document  ? 

A  That  document  was  classified  secret . 

Q  And  that  was  also  released  by  Wikileaks? 

A  Yes,    it  was. 

Q  And  according  to  the  product  what  could  be 

the  impact  to  the  United  States  if  that  were  released? 

A  The  impact  would  be  insight  into  a 

successful  asymmetric  warfare  tactic  technique  and 
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protection  operation  against  U.S.    forces  and  coalition 
forces . 

Q  And  is  this  an  intelligence  product? 

A  Yes,    it  is. 

Q  And  why  is  it  an  intelligence  product? 

A  Because  it  contains  intelligent  documents 

within  it . 

Q  Do  the  U.S.   government  entities  rely  on 

these  intelligence? 

A  Yes ,    they  do . 

Q  And  was  this  product  in  particular  used  by 

other  U.S.   government  entities? 

A  Yes,    they  were. 

Q  How  do  you  know  that? 

A  Because  people  have  discussed  it . 

Q  Was  this  product  ever  released  outside  of 

SIPRnet? 

A  No,    it  wasn't. 

THE  COURT:     You're  saying  this  product,  are 
you  talking  about  the    (INAUDIBLE) . 

CAPTAIN  OVERGAARD:      I'm  sorry,   ma'am.  I'm 


Provided  by  Freedom  of  the  Press  Foundation 


1 

2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 


UNOFFICIAL  DRAFT  -  6/10/13  Afternoon  Session 


147 

talking  about  the  A6  report . 

BY  CAPTAIN  OVERGAARD: 
Q  Was  this  was  the  2008  version  that  you're 

familiar  with  of  the  A6  report  ever  released  outside  of 
SIPRnet? 

A  To  my  knowledge  it  was  only  posted  on 

SIPRnet  and  JWICS  and  never  released  out  of  those  two 
sites . 

Q  Was  it  ever  unofficially  released? 

A  To  my  knowledge,   no,    it  wasn't. 

Q  You ' re  not  familiar  with  this  document 

being  unofficially  released  anywhere  else? 

A  Unofficially  released? 

Q  Not  officially,    unofficially  so  — 

A  I'm  sorry.      To  my  knowledge,   this  document 

was  never  unofficially  released. 

Q  So  — 

A  I'm  never  officially  released.      I'm  sorry. 

Was  it  unofficially  released? 

Q  Yes .     Do  you  know  if  this  document  was  ever 

released? 
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A  To  my  knowledge,   the  document  was  never 

released  even  unofficially.     To  my  knowledge,  this 
document  was  never  un —  officially  released? 

Q  Can  you  tell  us  —  can  you  tell  us, 

according  to  the  conclusion  of  this  document,   what  must 
be  presumed  about  adversary  access  to  Wikileaks?  I'm 
just  looking  at  page  21. 

A  It  must  be  presumed  that  Wikileaks 

organization  have  or  will  receive  sensitive  or 
classified  documents  in  the  future.      It  must  also  be 
presumed  that  foreign  adversaries  will  review  and 
assess  any  DoD  or  classified  information  posted  on  the 
Wikileaks.org  website. 

Q  Thank  you .     Was  this  document  ever  posted 

on  Wikileaks? 

A  Yes,    it  was. 

Q  And  how  do  you  know  that? 

A  Because  I  was  informed  by  an  individual  who 

saw  on  it  Wikileaks . 

Q  Do  you  have  firsthand  knowledge? 

THE  COURT:  Sustained. 
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BY  CAPTAIN  OVERGAARD: 
Q  Do  you  have  firsthand  knowledge  of  that? 

A  Yes ,    I  do . 

Q  What  is  the  firsthand  knowledge  of  that? 

A  I  received  a  phone  call . 

THE  COURT:  Sustained. 

BY  CAPTAIN  OVERGAARD: 
Q  Did  you  see  the  product? 

A  It  was  e— mailed  to  me . 

Q  And  it  was  from  Wikileaks? 

A  It  was  e— mailed  to  me  from  somebody  who 

took  it  off  of  the  Wikileaks. 

Q  How  do  you  know  that?     What  did  it  look 

like? 

A  It  looked  like  the  exact  same  document  that 

was  posted  on  our  website. 

Q  Did  it  have  any  particular  identifying 

marks  on  it  that  made  you  that  think  it  was  from 
Wikileaks? 

A  No,    not  the  document  that  I  received. 

Q  Okay . 
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A  Because  I  received  it  on  our  classified 

system. 

Q  Okay .      Thank  you . 

THE  COURT:  Cross? 

CROSS  EXAMINATION 
Q  I'm  going  to  retrieve  that  exhibit  from 

you,    Prosecution  Exhibit  45.      Thank  you. 

CAPTAIN  TOOMAN:     Ma'am,    I'm  going  to 
publish  this . 

THE  COURT:      Go  ahead. 
BY  CAPTAIN  TOOMAN: 
Q  I'm  now  publishing  page  1,  Prosecution 

Exhibit  45.     Ms.   Glenn,   my  first  question  to  your  is: 
You  talked  on  direct  about  the  title  of  this  document, 
correct? 

A  Yes . 

Q  And  you  read  it  to  the  Court .     Would  you 

agree  that  the  title  of  this  document  actually  has  a 
question  mark  at  the  end? 

A  Yes,    it  does. 

Q  And  so  that  would  suggest,   would  you  agree, 


Provided  by  Freedom  of  the  Press  Foundation 


1 

2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 


UNOFFICIAL  DRAFT  -  6/10/13  Afternoon  Session 

151 

that  we  don ' t  know  the  answer  to  that  question  or  this 
document  is  going  to  set  out  to  answer  that  question? 
Would  you  agree  with  that? 

A  Could  you  repeat  the  question? 

Q  Sure .     You  would  agree  that  based  on  the 

title  of  this  document,   that  is  a  question,   that  is  we 
don't  know  whether  foreign  intelligence  services, 
insurgents,    or  terrorist  groups  use  Wikileaks  as  an 
on— line  reference. 

Would  you  agree  with  that?  The  question 
mark  would  suggest  that  we  don't  know.  Do  you  agree 
with  that? 

A  The  question  mark  suggests  that  we  can't 

confirm  it . 

Q  Okay . 

A  Not  that  we  don't  know,   but  we  can't 

confirm  it . 

Q  Okay.      If  we  could  confirm  it  there 

wouldn't  be  a  question  mark  there,  correct? 

A  At  that  time,  yes. 

Q  I'm  sorry?     So  if  there  were  no  question 
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mark  there  you  would  agree  with  me  that  that  would 
suggest  that  foreign  intelligence  service,  insurgents, 
and  terrorist  groups  are  using  Wikileaks  as  an  on— line 
reference? 

A  During  that  time  frame  we  couldn't  confirm 

it. 

Q  Okay.     Now  I'm  going  to  remove  page  1  from 

the  overhead  and  place  page  2 .     You  talked  on  direct 
about  the  stated  purpose  of  Wikileaks,   and  I  would 
direct  your  attention  to  the  second  paragraph  from  the 
bottom  which  is  the  one  denoted  by  the  unclassified 
paragraphs  there.     Do  you  see  that? 

A  Yes . 

Q  You  would  agree  with  me  that  the  stated 

intent  of  Wikileaks  is  to  expose  unethical  practices, 
illegal  behavior,    and  wrongdoing  (INAUDIBLE) 
organizations  or  corporations,    and  oppressive  regimes 
throughout  the  world.      Is  that  accurate? 

A  That  was  the  stated  intent . 

Q  The  stated  intent  is  to  not  to  assist 

foreign  militaries,  correct? 
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A  I  can ' t  make  that  determination . 

Q  Well,   that  wasn't  stated,   you  would  agree 

with  that,  correct? 

A  That's  not  stated  within  the  document,  yes. 

Q  Okay.     Now,    continuing  to  talk  —  I've 

removed  page  2  from  the  overhead.      I'm  going  to  place 
page  6  on.     Continuing  to  talk  about  the  stated  purpose 
of  Wikileaks . 

I  want  to  direct  your  attention  to  the 
first  full  paragraph  there,   the  one  with  the  U  in 
parenthesis,    starts  Wikileaks.org.     Go  ahead  and  read 
that  first  paragraph  there  for  me .      I'll  point  to  that 
paragraph  with  my  pen . 

A  Wikileaks.org  — 

Q  Just  read  it  to  yourself,  ma'am? 

A  (Witness  reviewing  document . ) 

Okay . 

Q  Ma ' am,   based  on  this  report  would  you  agree 

with  me  that  one  of  the  purposes  or  the  goals  of 
Wikileaks  is  a  free  and  unrestrained  press?     Would  you 
agree  with  that  ma ' am? 
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A  Based  on  this  statement,  yes. 

Q  Removing  page  6.     Ma'am,    I'd  like  to  talk 

now  a  little  bit  about  how  these  documents  are  created. 
Okay?     Now,   you  talked  about  a  few  different  ways  in 
which  one  of  these  products  would  be  initiated. 

You  talked  about  it  could  be 
self —initiated,    correct,   and  that's  what  happened  in 
this  case? 

A  Yes . 

Q  I ' 11  just  ask  you  to  say  your  answer  out 

loud  for  the  purpose  of  the  court  reporter . 
A  Yes . 

Q  Another  way  would  be  through  an  RFI? 

A  Request  for  information,  yes. 

Q  Would  you  explain  what  this  is? 

A  That ' s  when  a  command  sends  us  through 

e-mail  or  a  request  for  information  on  a  particular 
item  and  then  we  would  research  it  and  use  a  product 
off  of  it. 

Q  So  if  there  were  requests  for  information, 

and  there  wasn't  a  request  for  information  in  this 
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case,  correct? 

A  No,    this  is  self —initiated . 

Q  So  no  unit  came  to  A6  and  said,   we  think 

that  maybe  Wikileaks  is  using,    or  the  enemy  is  using 
Wikileaks,   we'd  like  you  to  look  into  it,    correct,  that 
didn't  happen? 

A  No  request  of  information. 

Q  You  mentioned  a  third  way  in  which  one  of 

these  documents  would  be  initiated.     What  was  that, 
ma ' am . 

A  A  requirement . 

Q  And  could  you  explain  what  that  means? 

A  Of  that  through  our  production  system  a 

customer  will  put  in  a  request  for  assessment  and  then 
we  will  perform  that  assessment  based  on  their  request . 

Q  So  if  someone  had  said,   hey,   we  think  that 

maybe  Wikileaks  is  getting  used  by  the  enemy,  they 
could  have  used  that  process  in  order  to  have  this 
product  produced;   is  that  correct? 

A  Yes ,   they  could  have . 

Q  And  that  didn ' t  happen  here ,    correct  ? 
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A  No,    it  didn't. 

Q  Now,    I ' d  liked  to  speak  now  about  sort  of 

the  process  through  which  this  is  created.     Once  it's 
been  initiated  here  we  had  self —initiation  and  then  we 
talked  about  all  the  research  that  goes  into  it,  right? 

A  Yes . 

Q  And  I  think  you  talked  about  in  this  case 

it  would  be  Mr .   Horbach  or  whoever  drafted  the  document 
would  have  looked  at  JWICS;    is  that  correct? 

A  Yes . 

Q  And  so  Mr .   Horbach  work  look  at  JWICS  and 

he  would  have  been  looking  for  any  sort  of  intelligence 
that  would  have  helped  answer  the  question  posed  by 
this  paper? 

A  He  would  use  that,   but  that  wouldn't  be  the 

only  source  he  would  use . 

Q  Sure,    okay.     Within  JWICS  is  where  the 

United  States  government  keeps  top  secret  information, 
correct? 

A  There's  other  information  on  JWICS,  not 

only  top  secret . 
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Q  So  you  would  have  not  only  top  secret 

information  on  JWICS,   but  other  information  as  well? 
A  Yes . 

Q  There's  a  lot  of  information  on  JWICS? 

A  Yes . 

Q  You've  got  the  SIPRnet  and  that  includes 

secret  and  down,    correct,    and  then  JWICS  is  higher.  So 
there's  even  more  on  JWICS? 

A  Yes. 

Q  And  you  talked  about  a  number  of  things 

that  would  have  been  referenced  when  producing  this 
document? 


A 

Yes  . 

Q 

There ' 

s  human? 

A 

Yes  . 

Q 

Signet 

[sic] ? 

A 

Yes  . 

Q 

Osent 

[sic] ? 

A 

Yes  . 

Q 

Masent 

[sic] ? 

A 

Yes  . 
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Q  Did  I  miss  any? 

A  Imit    [sic] . 

Q  Okay.     So  all  of  those  ints  would  have  been 

looked  at  by  the  individual  who  drafted  this  document? 
A  Yes . 

Q  Pretty  much  the  author  of  this  document  had 

just  about  all  of  the  United  States  government ' s 
intelligence  at  their  fingertips.      Is  that  fair  to  say, 
with  some  very  limited  exceptions,   they  are  looking  at 
just  about  everything? 

A  Yes .      They  was  looking  at   just  about 

everything,  yes. 

Q  Now,    so  the  individual  who  drafted  the 

document  would  have  looked  at  all  of  this  information 
and  they  incorporated  that  into  their  document? 

A  If  they  found  something. 

Q  Sure.      If  they  found  something,    if  they 

found  a  source  they  would  have  noted  it  in  this 
document  and  then  after  the  document  was  written  it 
would  have  gone  out  for  external  coordination,  correct? 

A  Yes . 


Provided  by  Freedom  of  the  Press  Foundation 


1 

2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 


UNOFFICIAL  DRAFT  -  6/10/13  Afternoon  Session 


159 

Q  And  in  this  case  Mr.   Horbach  looked  at  all 

of  this  information,    all  of  JWICS,    all  the  ints  and 
then  he  sent  it  out  to  the  national  ground  intelligence 
center,  correct? 

A  Yes . 

Q  And  they  scrubbed  it  as  well? 

A  Yes . 

Q  And  so  if  they  would  have  had  any 

intelligence  that  maybe  Mr.   Horbach  missed  or  maybe 
didn't  have  access  to  they  could  have  added  it  on  this 
document ,    correct  ? 

A  Yes . 

Q  And  so  this  external  coordination  also  is  a 

process  through  which  we  can  make  sure  we  have  as  much 
intelligence  as  possible  in  forming  this  paper, 
correct? 

A  Yes . 

Q  Now,    I  want  to  talk  about  the  document 

itself.  Through  the  document  there  are  footnotes, 
correct? 

A  There  are  end  notes . 
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Q  End  notes  and  what  is  the  purpose  of  an  end 

note? 

A  The  purpose  of  the  end  note  is  to  list 

where  you  acquired  the  information  from. 

Q  So  it ' s  the  source,   is  that  accurate? 

A  Yes,    it's  the  source. 

Q  So  if  there  was  an  intelligence  report  that 

said  Captain  Tooman  eats  too  many  cookies  and  there 
would  be  an  end  note  and  you ' d  have  the  source  of  that 
information? 

A  Yes . 

Q  And  it  might  be  my  mother  or  someone  else? 

A  Yes . 

Q  That ' s  how  I  know  it  would  work? 

A  Yes . 

Q  I  want  to  —  I'm  going  to  publish  page  11. 

I ' 11  direct  your  attention  to  sort  of  the  middle  of  the 
paragraph  here  we  have  a  paragraph  that  was  secret,  no 
foreign,    it's  been  lined  through.      It  starts 
intelligence  indicates  that  insurgents .     Right  here . 
Do  you  see  that? 
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A  Yes . 

Q  That  says  intelligence  indicates  that  an 

insurgents  in  Afghanistan  have  recovered  several 
(INAUDIBLE)    systems  and  then  we  have  an  end  note.  And 
we  have  the  unclassified  version  of  this  document,  but 
if  we  were  looking  at  the  classified  version  we  can  go 
to  number  the  12  at  the  back  and  you  can  see  the  source 
of  that? 

A  Yes . 

Q  And  we  would  know  from  looking  at  that  the 

classified  document,  how  we  know  that  insurgents  in 
Afghanistan  have  recovered  several  warlock  systems? 

A  Yes . 

Q  That  would  be  some  intelligence  that  was 

gathered  from  the  JWICS  system  or  from  some  other 
source  that  the  author  referenced? 

A  Yes . 

Q  Or  it  could  have  been  something  that  the 

external  coordination  added  to  the  document  as  well, 
correct? 

A  Yes . 
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Q  I'm  going  to  remove  page  11.     Now,  would 

you  agree  with  me  that  this  document,  there  are  over  50 
end  notes? 

A  I'm  not  exactly  sure  how  many  end  notes 

it ' s  in  the  document .      I  don ' t  remember . 

Q  I'm  going  to  hand  the  witness  what's  been 

marked  as  Prosecution  Exhibit  45. 

Would  you  please  take  a  look  at  that  and 
just  let  us  know  how  many  end  notes  there  are? 

A  Fifty— five  end  notes. 

Q  I'm  going  to  retrieve  the  exhibit  from  the 

witness . 

So  within  this  document  there  are  55  facts 
or  pieces  of  intelligence  that  we  the  government  had 
verified?     That's  how  we  know  it,  correct? 

A  Yes.     Fifty— five  pieces  of  information  of 

end  notes  that  list  sources . 

Q  Would  you  agree  with  me  that  if  we  had  a 

source  for  something  it  would  be  listed? 

A  If  there  was  a  source  for  something  in  that 

document,    if  the  analyst  found  it,    it  would  be  listed; 
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but  that  does  not  mean  that  the  analyst  did  not  find 
all  the  sources . 

Q  Okay . 

THE  COURT :      That  does  not  mean  that  the 
analyst  did  not  find  all  the  sources?     I  don't 
understand  that . 

THE  WITNESS :      So  let ' s  say  an  analyst  is 
writing  product  and  some  sources  have  not  been 
published  yet.     So,   therefore,   that  analyst  who  wrote 
that  product  would  not  have  all  of  the  sources  for  that 
document,   but  he  will  write  the  documents  based  on  the 
sources  that  at  the  time  was  available. 

BY  CAPTAIN  TOOMAN: 
Q  So  there  might  be  some  intelligence  out 

there  that  he  just  hasn't  seen  yet? 
A  Yes . 

Q  And  he  wouldn ' t  incorporate  that  into  the 

document . 

A  Because  he  has  not  seen  it? 

Q  It  would  be  impossible  to  incorporate  it? 

A  Yes . 
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Q  Now,    I'm  going  to  publish  page  20  and  I'd 

like  to  focus  on  the  one  of  the  areas  in  the  template 
called  intelligence  gaps . 

Ma ' am,   you  would  agree  with  me  that  an 
intelligence  gap  is  something  that  we  don't  know, 
correct? 

A  Not  always . 

Q  Okay .     You  would  agree  with  me  that  it ' s 

something  that  —  a  gap  is  there's  something  missing, 
correct? 

A  Not  always . 

Q  What  is  a  gap? 

A  Sometimes  a  gap  could  be  information  that 

we  cannot  confirm. 
Q  Okay . 

A  We  know  it,   but  we  can't  confirm  that  it's 

actually  true . 

Q  Okay .     And  you  would  agree  with  me  that  in 

cases  where  you  know  something  you  would  cite  it, 
correct,   you  would  cite  a  source  for  it?     If  you  know 
it  you  cite  the  source  for  it,  correct? 
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A  If  the  source  can  confirm  it  —  we  can  know 

something  but  we  can't  confirm  it.      So  we  cannot  put  it 
in  the  document  because  it ' s  not  —  it ' s  not 
corroborated . 

Q  When  you  say  you  can't  confirm  it,   you  mean 

you  don't  really  know,   you  can't  say  for  sure  that  you 
know  in? 

A  I  can ' t  say  for  sure  that  I  know  it . 

Q  If  you  had  even  any  sort  of  source  or 

intelligence  you  would  have  —  would  you  cite  that  in 
the  document,    correct?     You  wouldn't  have  a  source  for 
something  and  then  just  leave  that  source  out,  right? 

A  If  I  can't  confirm  the  source,   yes,    I  would 

leave  it  out . 

Q  Because  you  can't  confirm  it,   you  don't 

know  for  sure? 

A  Not  necessarily  that  I  don't  know  for  sure. 

I  cannot  not  confirm  the  source  is  accurate. 

Q  If  you  knew  for  sure,   you  would  put  the 

source  in  there,  right? 

A  If  the  source  is  verified,   yes,    I  would  put 
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the  definition  in  there. 

Q  Now,    I  want  to  talk  about  these 

intelligence  gaps .      I'd  like  to  direct  your  attention 
to  the  third  one . 

You ' d  agree  with  me  that  this  says  would 
the  Wikileaks.org  website  be  used  by  FISS,  that's 
foreign  intelligence  services;    is  that  correct? 

A  Yes . 

Q  Foreign  military  services,  foreign 

insurgents,    or  terrorists  groups  to  collect  sensitive 
or  classified  or  U.S.   Army  information  posted  to  the 
Wikileaks.org  website?     That's  listed  as  an 
intelligence  gap,  correct? 

A  Yes. 

Q  So  that's  something  you  can't  confirm? 

A  No,   we  can't  confirm  that. 

Q  And  would  you  agree  with  me  that  there  is 

no  end  note  at  the  end  of  that  intelligence  gap, 
correct? 

A  Intelligence  gaps  we  don ' t  put  end  notes  on 

intelligence  gaps . 
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Q  Because  you  don ' t  have  sources  for  them? 

A  They ' re  gaps . 

Q  There  is  not  an  end  note,   but  there  is  a 

question  mark? 

A  Yes . 

Q  Again,    a  question  mark  would  indicate  that 

it's  something  that  we  are  looking  for  the  answer  to, 
right? 

A  Something  we  can ' t  confirm  the  answer  to . 

Q  If  we  had  the  answer,    it  wouldn't  be  in  the 

intelligence  gap  section,  correct? 

A  If  we  can't  confirm  it  then  we  put  it  in 

the  intelligence  gaps . 

CAPTAIN  TOOMAN:     Your  Honor,    I  have  no 
further  questions.      I'm  going  to  remove  page  20  of 
Prosecution  Exhibit  45  and  return  it  to  the  court 
reporter . 

THE  COURT:  Redirect? 

CAPTAIN  OVERGAARD :      Just  one  moment , 

please . 

REDIRECT  EXAMINATION 
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Q  So  you  started  explaining  about 

intelligence  gaps  a  little  bit  when  defense  asked  you 
about  it,   but  I  want  to  hear  in  own  words  what  is  an 
intelligence  gap? 

A  That  is  easier  if  I  give  you  an  example. 

Q  Okay . 

A  Let's  say  I  look  at  an  organization.  I 

know  the  organization  name.      I  know  that  organization 
has  five  branches.      I  know  four  of  the  branch  names, 
but  the  fifth  branch  I'm  not  exactly  sure  what  the  name 
is .      I  have  an  idea  of  what  it  could  possibly  be  based 
on  the  structure,   but  I  cannot  confirm  if  that's  the 
actual  name.     That's  an  example,   one  example  of  an 
intel  gap . 

Q  How  about  using  the  example  that  defense 

pointed  out.     What  can  be  confirmed,    or  can  you  explain 
why  that's  an  intelligence  gap,   what's  confirmed  and 
what  needs  verification?     How  does  that  work? 

A  In  this  particular  example  we  know  that 

intelligence  organization  and  terrorist  groups  perform 
open  source  intelligence,   but  we  cannot  confirm  if  they 
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actually  visit  that  cite  and  looked  at  the  information. 
CAPTAIN  OVERGAARD :      Just  one  moment , 

please . 

BY  CAPTAIN  OVERGAARD: 
Q  And  then  after  the  intelligence  gaps,  what 

does  the  conclusion  says  starting  with  in  addition? 

A  It  says,    in  addition,    it  must  also  be 

presumed  that  foreign  intelligence  —  foreign 
adversaries  will  arrive  and  assess  any  DoD  sensitive  or 
classified  information  posted  to  the  Wikileaks.org 
website . 

Q  Thank  you. 

THE  COURT:  (INAUDIBLE) 

RECROSS  EXAMINATION 
BY  CAPTAIN  TOOMAN: 
Q  Now,   you  said  that  an  intelligence  gap 

would  be  something  that  you  can't  confirm.     You  would 
agree  that  an  intelligence  gap  would  also  be  something 
we  have  no  idea  about? 

A  It  could  be . 

Q  It  could  be.     And  you  talked  just  now  about 
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presuming  something.     How  do  you  define  presume,  ma'am? 
A  How  do  I  define  presume? 

Q  Yes . 

A  That  quote  was  based  on  historical  analysis 

of  what  foreign  intelligence  services  and  terrorist 
organizations  do .     We  know  they  conduct  open  source 
intelligence  and  we  know  that  they  are  interested  in 
classified  and  sensitive  U.S.   government  information. 

So  based  on  what  we  know  we  presume  that 
they  will  look  at  that  site  if  that  information  is 
posted  there . 

Q  But  you  have  no  intelligence  that  the  enemy 

or  those  groups  have  ever  gone  to  Wikileaks . org? 

A  At  that  time,    during  that  time  frame  we 

could  not  confirm  it . 

Q  And  you  also  couldn't  say  if  they  were 

going  to  go  there  in  the  future? 

A  We  know  that  they  do  open  source  research . 

We  know  they  have  certain  key  words  they  use  to  search 
with,  and  we  know  if  this  classified  information,  that 
information  will  be  reviewed  and  assessed. 
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Q  And  you  presume  that?     You  — 

A  We  know  that  they  visit  websites. 

Q  You  know  they  visit  websites,   but  you  don't 

know  they  visit  Wikileaks? 

A  We  cannot  confirm  that  they  didn't  visit 

Wikileaks . 

Q  You  have  no  intelligence  to  suggest  that 

they  have  ever  been  to  Wikileaks  at  that  time? 

A  We  couldn't  confirm  it  at  that  time  that 

they  visited  Wikileaks . 

Q  And  if  you  would,   ma'am,   please,  you've 

explained  that  conclusion,   but  what  just  the  word 
presume,   what  does  that  mean  to  you,  ma'am? 

A  Presume? 

Q  Presume . 

A  Presume  to  me  means  that  we  will  —  presume 

means  that  we  think  that  they  will  visit  that  website. 

CAPTAIN  TOOMAN :     Okay .      Thank  you ,   ma ' am . 
THE  COURT:     Any  final  redirect? 
CAPTAIN  OVERGAARD:     Yes,  ma'am. 
REDIRECT  EXAMINATION 
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Q  You  said  on  cross  you  could  not  confirm 

enemies  saw  Wiki leaks  in  2008? 

A  In  2008  we  could  not. 

Q  How  about  in  2009? 

A  In  2009,   we  could  not. 

Q  And  how  about  in  2010? 

A  In  2010,   we  could  not. 

CAPTAIN  OVERGAARD:      Thank  you. 
THE  COURT:      I   just  have  one  question  for 
you  to.     You  talked  about  the  three  different  ways  that 
reports  are  generated  the  self-initiate  have  had  versus 
the  RFI  versus  the . 

THE  WITNESS:       (INAUDIBLE) . 
THE  COURT:      In  terms  of  frequency,  how 
frequently  are  self-initiated  reports  generated  versus 
the  other  two?     Are  they  unusual? 

THE  WITNESS:     No,    they're  not.  They're 
common.      Self —initiated  on  our  mission  statement  we 
identify,    you  know,    threats  to  the  United  States  Army 
counterintelligence  threats  to  the  United  States  Army. 
So  we  are  always  looking  for  threats  to  the  United 
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States  Army.      So  self —initiate  the  products  are 
produced  often  within  our  organization. 

THE  COURT :     Any  follow-up  questions  based 

on  mine? 

CAPTAIN  OVERGAARD:      No,  ma'am. 
CAPTAIN  TOOMAN:     No,  ma'am. 

THE  COURT :      Temporary  or  permanent  excuse 

(INAUDIBLE) . 

CAPTAIN  OVERGAARD :      Temporary . 

THE  COURT :     Ma ' am,    you ' re  temporarily 
excused.     Don't  discuss  the  case  with  anyone  other  than 
counsel  of  the  accused  while  the  trial  is  still  going 
on .      Thank  you ,   ma  ' am . 

Is  there  any  further  evidence  either 
side  want  to  put  on  the  today? 

MAJOR  FEIN:     No,  ma'am. 

MR.   COOMBS:     No,   Your  Honor. 

THE  COURT:     Before  we  recess  the  court  I  do 
want  to  go  over  a  timeline  for  deciding  today's  issues 
on  objections  for  Prosecution  Exhibit  31,    32  and  109. 

I  would  like  the  parties  to  put  in 
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writing  the  government  what ' s  the  relevance  of  these 
what  hearsay,   nonhearsay  purpose.     Defense  sort  of 
put  the  issues    (INAUDIBLE)    if  you  will,    the  issue 
off  on  the  table . 

I'm  not  going  to  have  the  government 
file  first  and  then  you  file  first.     You  have  the 
gist  of  what  they ' re  bringing  in .     We  can  have  an 
oral  argument  if  they  create  something  knew,    then  we 
can  address  it  there. 

I  understand  we ' ve  got  a  busy  week  and 
you  all  are  bringing  in  witnesses  and  doing  that . 
If  we  take  a  little  bit  of  time  to  file  these  briefs 
and  for  me  to  rule.     Are  these  exhibits  going  to  be 
introduced  with  any  other  witnesses  that  are  coming 
tomorrow  or  the  next  day? 

CAPTAIN  MORROW:     No,    Your  Honor. 

THE  COURT :     What ' s  the  window  of  time  that 
we're  looking  at  before  we  have  to  have  that  issue 
resolved? 

CAPTAIN  MORROW:      I  believe  the  end  of  the 
week  is  probably  sufficient  to  get  this  resolved. 
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THE  COURT :     Okay .     What  is  a  reasonable 
timeline  in  light  of  your  schedules  with  witnesses  and 
preparation  and  getting  everybody  here  without  delaying 
the  proceedings  to  be  able  to  come  up  with  these 
filings . 

MAJOR  FEIN:     United  States  would  offer 
three  days .     We ' 11  have  it  by  COB  on  Thursday . 

THE  COURT:      COB  on  Friday,    and  you  want  me 
to  rule  by  the  end  of  the  week . 

MAJOR  FEIN:  Thursday. 

THE  COURT :     You  want  me  to  rule  Friday 

morning . 

MAJOR  FEIN:     Very  short  and  concise,  brief. 
We  can  go  earlier,  ma'am. 

THE  COURT :      Let ' s  do  Wednesday .      Can  you  do 

that? 

MR.   COOMBS:     We  are  at  a  disadvantage 
because  all  of  us  are  in  court .     The  government  has 
other  counsel . 

THE  COURT:      If  you  get  it  to  me  by  the  end 
of  the  week  and  I  rule  on  Monday,   will  that  work? 
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MR.   COOMBS:     Yes,    that  will. 

CAPTAIN  MORROW:      I  thought  that  it  could  be 
submitted  by  the  end  of  the  week  and  then  move  on . 
THE  COURT:      The  following  week? 
CAPTAIN  MORROW:  Yes. 

THE  COURT :      So  we  have  a  COB  on  Thursday . 
Does  that  work?     That  way  if  there's  any  issues  we  can 
address  it  on  it  Friday    (INAUDIBLE) . 

MR.   COOMBS:     We're  looking  at  COB  Friday? 

THE  COURT :     We ' re  looking  at  COB  Saturday . 

MAJOR  FEIN:     Friday  works,  ma'am. 

MR.   COOMBS:      If  you  give  me  Saturday,  I'll 
take  Saturday . 

CAPTAIN  MORROW :     One  moment ,   Your  Honor . 

MAJOR  FEIN:      Saturday  is  fine  as  well 

ma ' am . 

THE  COURT :     We ' 11  do  COB  Saturday  and  what 
I  would  ask  is  you  identify  all  that  you  know  of  and 
can  you  get  me  the  copies  of  whatever  of  those 
authorities  are  that  you  have    (INAUDIBLE) . 

MR.   COOMBS:      I'll  get  those  to  you. 
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THE  COURT :      Government ,    the  same  thing . 
Give  them  to  me  as  soon  as  you  can  and  I'll  expect  your 
briefs  on  Saturday  and  we'll  go  next  week. 

CAPTAIN  TOOMAN:     Would  you  like  hard  copy 
or  e-mail  electronic? 

THE  COURT:     Both.      Is  there  anything  else 
we  need  to  address  today? 

MAJOR  FEIN:     No,  ma'am. 

MR.   COOMBS:     Nothing,    Your  Honor. 

THE  COURT:      Start  same  time  tomorrow. 

CAPTAIN  MORROW:     With  respect  to  authority 
are  you  speaking  specifically  to  the  Internet  archive 
of  Twitter . 

THE  COURT :     No .      I'm  speaking  legal 
authority .     They  cited  three  case . 

CAPTAIN  MORROW:     Related  to  the  Internet 
archive,   related  to  the  authentication  of  the 
information . 

THE  COURT:      If  you  have  any  authority  that 
is  germane  to  this  motion  or  any  of  the  three 
objections .      I  believe  they  are  the  hearsay, 
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authentication,   and  relevance  that  you  want  me  to  —  or 
that  you  already  have  that  you  want  me  to  consider,  I 
would  appreciate  it .     More  time  it  is  always  better  for 
me . 

CAPTAIN  MORROW:     Yes,  ma'am. 

THE  COURT:      Is  there  anything  else  we  need 

to  address? 

CAPTAIN  TOOMAN:     No,  ma'am. 
THE  COURT:      The  court  is  in  recess. 
(Hearing  adjourned  at   6:51  p.m.) 
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